Can't Delete Active Directory Cross-Ref? Fix 0x000020B7 Fast

Why You're Seeing This Error

You're working in Active Directory—maybe cleaning up old trust references or removing a stale naming context—and you try to delete a crossRef object. Boom. You get ERROR_DS_CANT_DEL_MASTER_CROSSREF (0x000020B7). It says "It is not permitted to delete a master cross-reference." And you're probably thinking, "What does that even mean?"

Let me save you the frustration I've seen in dozens of help desk calls. The short version: you can't delete the cross-reference that's flagged as master on a domain controller that's the original source. You need to either change that flag or delete it from the replica. I'll walk you through the fastest fix.

The Fix: Change the Master Flag with ADSI Edit

This fix uses ADSI Edit—the built-in tool every admin should know. It's direct and it works. Don't use any third-party tools; you don't need them.

Step 1: Open ADSI Edit

1. Press Windows + R, type adsiedit.msc, hit Enter. If UAC prompts, click Yes.
2. Right-click ADSI Edit in the left pane, choose Connect to.
3. In the dialog, set the Naming Context to Configuration (that's where cross-references live). Leave the server blank unless you're on a remote DC—then type the DC's name.
4. Click OK. You'll see a tree expand under Configuration [server.domain.com].

Step 2: Locate the crossRef Object

1. Navigate down this path: CN=Configuration,DC=domain,DC=com → CN=Partitions.
2. Under CN=Partitions, you'll see a list of CN=... objects. Each one is a cross-reference. Look for the one you tried to delete—it'll have a name like CN=some-contoso-com.
3. Right-click that object, choose Properties.

Step 3: Clear the Master Flag

1. In the Attribute Editor tab, scroll down to msDS-masterDC. Double-click it.
2. You'll see a value like CN=NTDS Settings,CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,.... That's the master DC. Delete this value entirely—clear the field so it's empty. Click OK.
3. Now find msDS-masteredBy. Double-click it. You'll see the same DN. Remove it too. Click OK.
4. Click OK on the Properties window to save changes.

What you should see: After clicking Apply, the object's icon won't change visually, but the master reference is gone. You've essentially made it a non-master cross-reference.

Step 4: Delete the crossRef Object

1. Back in ADSI Edit, right-click the CN=... object again.
2. Choose Delete. Confirm when prompted.
3. If it succeeds, you're done. No error.

Expected result: The object vanishes from the list. You won't see error 0x000020B7 again for this one.

Why This Works

Active Directory's crossRef objects hold references to naming contexts (partitions). The master one is the authoritative copy—usually created when you add a domain or trust. That master flag is stored in two attributes: msDS-masterDC (the DC that owns it) and msDS-masteredBy (the NTDS settings object of that DC). AD won't let you delete the master because it thinks you're breaking the partition's origin. By clearing those attributes, you tell AD, "This is no longer the master," and then deletion is just a normal object delete.

One thing I've learned: don't try to delete crossRef objects through AD Domains and Trusts. That tool also blocks it. ADSI Edit gives you the raw control.

Less Common Variations

Sometimes 0x000020B7 shows up in different scenarios. Here are two I've seen:

• Replication conflict: If you have multiple DCs and replication hasn't finished, the master flag might be stale. Force replication with repadmin /syncall /AdeP first. Then try the fix above.
• Read-only DC (RODC): You can't modify cross-refs on an RODC at all. Run ADSI Edit against a writable DC. The error will still pop if you're on the wrong server.
• Orphaned crossRef: Sometimes the master DC is offline or dead. In that case, the msDS-masterDC attribute might point to a nonexistent server. Clear it anyway—it'll still work.

Prevention

To avoid this error in the future, follow these rules:

• Always check the master flag before deleting a cross-ref. Use ADSI Edit to peek at msDS-masterDC. If it's set, you'll hit the error.
• Delete from the replica DC first if you can. Replicas don't have the master flag, so deletion works directly. Then remove the master later.
• Document your cross-references. If you're cleaning up old trusts or partitions, note which DC is the master. Use repadmin /showrepl to cross-check.
• Test in a lab. I always spin up a test DC with a dummy cross-ref before touching production. Saves your hide.

That's it. You now know how to kill 0x000020B7 dead. If you still see it after clearing the master flag, check replication—it's usually that. Good luck.