Active Directory Tree Delete Error 0X00002135 Fix

You're trying to delete an Organizational Unit (OU) or container in Active Directory, and you get this error: 0X00002135. The full message says tree deletions starting at an object that has an NC head as a descendant are not allowed.

I've seen this a lot. It almost always happens when someone tries to clean up a failed domain controller or a misconfigured child domain. The culprit is a domain controller (or a naming context head) sitting as a child object of whatever you're trying to delete. AD won't let you delete a tree that includes a domain controller.

Here's the breakdown of the three most common causes and how to fix each one.

Cause 1: A Domain Controller Lives Under That OU

This is the number one reason. Someone promoted a server to a domain controller and put its computer object inside an OU that you're now trying to delete. Or a lingering domain controller object wasn't cleaned up properly. AD sees that object as an NC head (naming context head) — basically a domain partition. You can't delete that.

How to Find the Hidden Domain Controller

1. Open Active Directory Users and Computers (dsa.msc).
2. Enable Advanced Features from the View menu.
3. Navigate to the OU or container you want to delete.
4. Look for any object with a Domain Controller icon (a server with a blue circle). It might also show as a computer object with the serverReference attribute set.
5. If you see one, right-click it and select Properties → Object tab. Check the nCName attribute. If it's set, that object is an NC head.

The Fix: Demote or Delete the Domain Controller

If the DC is still running, demote it using Server Manager or PowerShell:

Uninstall-ADDSDomainController -DemoteOperation -ForceRemoval

If the DC is already dead or unreachable, use ntdsutil to forcibly remove it from the domain:

ntdsutil
metadata cleanup
connections
connect to server <yourGoodDC>
quit
select operation target
list domains
select domain <number>
list sites
select site <number>
list servers in site
select server <number>
quit
remove selected server

After removal, go back to AD Users and Computers and delete the orphaned computer object. Then you can delete the OU.

Cause 2: A Child Domain Exists Under This OU

Less common but happens when someone creates a child domain and the parent OU was used to store that domain's objects. This can occur during a domain rename or migration gone wrong. The child domain's NC head sits as a child object under the OU.

Check with ADSI Edit

1. Open ADSI Edit (adsiedit.msc).
2. Connect to the Default Naming Context.
3. Find the OU in question and expand it.
4. Look for an object with domainDNS as its objectClass. That's your child domain NC head.

The Fix: Remove the Child Domain Reference

You can't just delete this object through ADSI Edit — AD won't allow it. You need to use ntdsutil to clean up the child domain metadata. On a domain controller in the parent domain, run:

ntdsutil
metadata cleanup
connections
connect to server <parentDC>
quit
select operation target
list domains
select domain <number of child domain>
quit
remove selected domain

Once the child domain metadata is gone, the child domain object should disappear. Then you can delete the OU.

Cause 3: A Dead Domain Controller Object with Stale Attributes

Sometimes a domain controller object gets corrupted or left behind after an unclean demotion. It might not show as a DC in ADUC but still has the nCName attribute set. This is a special case that trips people up because the object looks like a regular computer or server.

Find It with PowerShell

Get-ADObject -Filter {nCName -like "*"} -SearchBase "OU=YourOU,DC=domain,DC=com" -Properties nCName

This returns any object under that OU that has an nCName attribute. If you get a result, that object is an NC head.

The Fix: Delete the Stale Object with ADSI Edit

You can't delete it with ADUC directly. Use ADSI Edit:

1. Open ADSI Edit and connect to the Default Naming Context.
2. Browse to the object, right-click it, select Delete.
3. Confirm the deletion. It might prompt you about the NC head — say yes.

After that, try deleting the OU again. It should work.

Quick-Reference Summary Table

That's it. Nine times out of ten, it's Cause 1. Start there, save yourself the headache. If you still can't delete the OU after these steps, check replication — make sure all domain controllers have the same view of the directory. A lingering object can hide.