Fix ERROR_DS_MASTERDSA_REQUIRED (0X0000207A) in AD

This error pops up when you try to change a read-only domain controller (RODC) like it's a regular DC. The fix is to run the operation on a writable domain controller.

When you'll see this error

You're sitting at a domain-joined machine, trying to change a group membership or reset a password. Or maybe you're running dsmod or ntdsutil against a domain controller you think is writable. Then—bam—the error pops up: "The operation must be performed at a master DSA." The exact code is 0X0000207A. I've seen this most often after someone stands up a new branch office RODC and then tries to do admin tasks directly on it.

Root cause in plain English

You're trying to write data to a domain controller that's read-only. Windows Server 2008 introduced RODCs (Read-Only Domain Controllers). They're designed for locations where physical security is questionable—like a remote office with no locked server room. An RODC holds a read-only copy of the AD database. It can't accept writes. No new users, no group changes, no password resets. Any write operation has to go to a writable DC (a "master DSA" in old-school terms). The error is AD's way of saying "You can't do that here."

How to fix it

Step 1: Confirm you're on an RODC

Open Command Prompt as Administrator. Right-click the Start button, choose Command Prompt (Admin) or PowerShell (Admin).
Type nltest /dsgetdc:yourdomain.com (replace yourdomain.com with your actual domain name).
Look at the output. If it says "DC is a Read-Only Domain Controller" or you see something like Flags: PDC GC DS 0x8 REMOTE with the 0x8 bit set, that means it's an RODC.

Expected result: The output clearly shows whether the DC is writable or read-only. If you're not on a DC at all, it'll list a remote DC—check its flags.

Step 2: Identify a writable domain controller

Run nltest /dsgetdc:yourdomain.com /PDC. This gets the PDC emulator, which is always writable.
Alternate command: nltest /dsgetdc:yourdomain.com /GC — gets a global catalog server. Most global catalogs are writable (unless you've specifically configured an RODC as a GC, which is possible but not common).
Note the DC name that appears, e.g., DC01.yourdomain.com.

Expected result: You'll see a name like \DC01.yourdomain.com. That's your target.

Step 3: Rerun your original operation, targeting the writable DC

How you do this depends on the tool you were using. Here are the common ones:

Active Directory Users and Computers (ADUC): Right-click the domain in the left pane, choose "Change Domain Controller," then pick the writable DC from the list. After that, try your operation again.
ADSI Edit: Right-click the connection node, choose "Settings," and specify the writable DC's name in the "Server" field.
dsmod or dsadd commands: Add the -s parameter followed by the writable DC name. Example: dsmod group "CN=Admins,OU=Groups,DC=yourdomain,DC=com" -addmbr "CN=jdoe,CN=Users,DC=yourdomain,DC=com" -s DC01.yourdomain.com
PowerShell Active Directory module: Use the -Server parameter. Example: Set-ADUser jdoe -Department "Sales" -Server DC01.yourdomain.com
ntdsutil: At the ntdsutil prompt, type connect to server DC01.yourdomain.com before running your operation.

Expected result: The operation should complete without the 0X0000207A error. You'll get a success message or no error.

Step 4: (If needed) Force replication to the RODC

Even though your write went to the writable DC, the change won't appear on the RODC until replication happens. By default, RODCs pull changes every 15 minutes. If you need the change right now:

On the writable DC, open Command Prompt as Administrator.
Run repadmin /syncall /AdeP. This forces all replication partners to sync.
Wait a minute, then check the RODC. On the RODC, run repadmin /showrepl to see the last sync time.

Expected result: The change appears on the RODC within a few seconds to a minute.

What to check if it still fails

If you're still getting the error after targeting a writable DC, here's what I'd check next:

DNS: Make sure the writable DC's hostname resolves correctly. Run nslookup DC01.yourdomain.com. If it fails or returns a different IP, fix DNS first.
Firewall: Port 389 (LDAP) and 636 (LDAPS) need to be open between your machine and the writable DC. Try Test-NetConnection DC01.yourdomain.com -Port 389 in PowerShell.
Authentication: Your user account needs permissions to perform the operation on the writable DC. Are you a domain admin or delegated admin? If you're a regular user, you'll get access denied rather than this specific error, but it's worth verifying.
Site topology: Active Directory sites might force you to a local RODC. If you're in a remote site, your client might automatically connect to the RODC. Use nltest /dsgetsite to see which site you're in. Manually specify the writable DC using the -s flag or GUI option.
One rare case: If the writable DC itself is stuck in a weird state (e.g., not fully promoted, or tombstoned), you'll get odd errors. Run dcdiag /v on the writable DC to check its health.

That's the whole deal. Don't try to make an RODC writable—it's not designed for that. Just point your tools at a real writable DC and move on.