AD Child NC Error 0X000021A5 — Fixing the Partition Mess

1. You're Trying to Create a Parent Partition Name That Already Has a Child

This is by far the most common cause. Happened to a client last month who was migrating DNS zones between domains and accidentally tried to add an application partition with a name like DC=MyDomain,DC=com when a child partition like CN=MicrosoftDNS,DC=MyDomain,DC=com already existed. The DS won't let you create a parent below an existing child — it's like trying to build a floor under a house.

The fix: you need to either rename your new partition (easiest) or delete the existing child partition first (if you're sure it's not needed).

Check for Existing Child Partitions

Open adsiedit.msc and connect to the Configuration partition (or the partition you're targeting). Navigate to CN=Partitions,CN=Configuration,DC=yourdomain,DC=com. Look for any CN=... entries that are children of the name you're trying to add. If you see one, that's your blocker.

Alternatively, use ntdsutil:

ntdsutil
partition management
connections
connect to server localhost
quit
list

Look for any partition that starts with the same name you're trying to create but has extra components (like CN=... after the DCs).

Quick Fix: Change Your Partition Name

This is the fastest path. If you're adding a DNS application partition and wanted DC=MyDomain,DC=com, change it to something like DC=Zone1,DC=MyDomain,DC=com instead. The DS doesn't care what you call it — it just enforces the hierarchy rule.

If You Must Delete the Child Partition

Only do this if the child partition is orphaned or no longer needed. I've seen DNS child partitions left behind after domain renames. Use ntdsutil to remove it:

ntdsutil
partition management
connections
connect to server localhost
quit
select operation target
list domains for cross ref
select domain 0   (or the index matching the child NC)
delete NC

Then confirm the deletion. After that, you can add your partition.

2. Cross-Reference Partition in ADSI Edit Has a Stale Child

Sometimes the error pops up even when you think there's no child partition. I've seen this when a domain controller was demoted badly and left a ghost cross-reference entry. The CN=Partitions container in Configuration has a stale CN=... object that points to a partition that no longer exists, but the DS still sees it as a child.

You'll know this is the case if you run ntdsutil partition list and see nothing, but adsiedit shows the entry.

Fix: delete the stale cross-reference in adsiedit. Navigate to CN=Partitions,CN=Configuration,DC=yourdomain,DC=com. Find the object with cn= matching the child partition name (or something close). Right-click delete. Then retry your partition add. I've done this on Server 2012 R2 through 2022 without issue.

3. You're Trying to Add an Application Partition with the Wrong Naming Context

This one's sneaky. AD LDS or application partitions sometimes have the same LDAP display name as an existing domain partition. For example, if you already have DC=Test,DC=com as a domain and you try to add an application partition with the same name, you get 0X000021A5. The DS sees the domain as a parent partition and your app partition as a child — but since the domain is the top-level, there's no conflict, yet the error still fires because the naming context already exists.

The real fix: check if that partition name is already in use. Run dcdiag /test:crossref from an elevated command prompt. If it reports duplicate or orphaned cross-references, clean them up with adsiedit as described in cause #2.

If the name matches a domain partition, you're out of luck — can't have two partitions with the same name. Rename your app partition to something unique, like DC=AppData,DC=Test,DC=com.

Quick-Reference Summary Table

Start with cause #1 — that's where 90% of cases land. If you're still stuck after those fixes, check your forest functional level. Old 2003 functional levels sometimes have stricter hierarchy rules. Raise it to 2008+ if possible. But honestly? I've never seen that cause this specific error. Stick with the partition name conflict.