0x4E2: Domain Controller Already Exists – Real Fixes

1. A Live Domain Controller with That Name Still Exists

What's actually happening here is that Active Directory's replication engine has a record of a domain controller using the exact name you're trying to promote. The error 0x000004E2 (decimal 1250) fires because AD won't let you register a duplicate SPN or NTDS settings object. This happens most often when someone tries to re-promote a server after a failed demotion where the metadata wasn't cleaned up.

The real fix is to check if that DC is still running. Fire up PowerShell on any domain-joined machine:

Get-ADDomainController -Identity "MESSY-DC" -Server "yourdomain.com" | fl Name, Site, IPv4Address, OperatingSystem

If the command returns an object, that DC is still alive somewhere. You need to either demote it properly or, if it's a zombie server that got wiped and reimaged, clean its metadata from AD.

If the server is reachable, run the demotion wizard on it directly. Open Server Manager, go to Manage → Remove Roles and Features, and uncheck Active Directory Domain Services. That triggers the demotion and removes the NTDS settings object. Reboot, then try promoting again.

If the server is dead or unreachable, skip to cause #2 below.

2. Stale Metadata in Active Directory from a Dead DC

This is the second most common cause. You had a DC named SRV-OLD that got formatted or crashed, but its metadata still lives in the Configuration partition. When you try to promote a new server with that same name, AD sees the old NTDS Settings object and throws 0x000004E2.

The fix is manual metadata cleanup using ntdsutil. Do this on any healthy DC:

1. Open an elevated command prompt and type ntdsutil
2. Type metadata cleanup
3. Type remove selected server SRV-OLD
4. Type quit twice to exit

That's the old way. The better way is to use Active Directory Sites and Services:

1. Open dssite.msc
2. Expand the site where the dead DC lived
3. Expand Servers, right-click SRV-OLD, choose Delete
4. Confirm the deletion

The reason step 3 works is that it removes the server object, which cascades and deletes the NTDS Settings object. Once that's gone, the name is free for reuse.

Don't skip checking DNS for the old DC's A/AAAA records. Even with clean metadata, if DNS still has an SRV record pointing to the old IP, DCLocator might confuse things during promotion. Run this:

Get-DnsServerResourceRecord -ZoneName "yourdomain.com" -Name "_msdcs" | Where-Object {$_.RecordData.DomainNameServer -like "*SRV-OLD*"}

Delete any stale records you find.

3. DNS Scavenging Disabled – Stale SRV Records from a Decommissioned DC

Third most common but often overlooked. Even after metadata cleanup, if DNS scavenging is off (default on many older domains), old SRV records from a DC that was removed months ago can still be alive. When the promotion wizard queries DNS for the name you're trying to use, it finds the old SRV record and assumes a DC already exists.

Check the _tcp and _msdcs zones for records like _kerberos._tcp.dc._msdcs.yourdomain.com pointing to the old server name. You can dump them with:

dnscmd /EnumRecords yourdomain.com _tcp /Additional

Or use the DNS Manager console: expand Forward Lookup Zones → yourdomain.com → _tcp, then delete any records referencing the old DC name.

After cleaning, force a scavenge on the DNS server: right-click the server in DNS Manager, select Scavenge Stale Resource Records. Then wait a replication cycle (or force it with repadmin /syncall) before retrying promotion.

One more thing: if you're promoting a new DC with the same IP as the old one, make sure no other device on the network is handing out that IP via DHCP or has an ARP cache conflict. That's rare but I've seen it.

Quick-Reference Summary