ERROR_DS_MISSING_SUPREF (0X000020D6) Fix: No Superior Reference

What triggers this error?

I've seen this error pop up mostly after a domain controller gets forcefully demoted or when someone deletes a trust object without using the proper tools. You're looking at a domain controller that's stuck—it can't talk to its parent domain because the reference is just gone. The exact error code is 0X000020D6, and the message says "No superior reference has been configured for the directory service."

This tripped me up the first time too. The domain controller thinks it's the root of a forest when it isn't, or it's orphaned from its parent. Here's how to get it talking again.

Quick fix: Check trust status (30 seconds)

Before you do anything heavy, verify if the domain controller even knows about its parent domain.

1. Open Active Directory Domains and Trusts on the affected server.
2. Right-click the domain name and select Properties.
3. Check the Trusts tab. Do you see a parent trust listed? If it's missing, you've found the problem.

If the trust is missing but should be there, you can try re-creating it manually—but honestly, this rarely sticks if the object is corrupted. Move to the moderate fix.

Moderate fix: Use repadmin to check and force replication (5 minutes)

This step confirms the issue and sometimes triggers a self-heal. Run a command prompt as Administrator.

1. Type repadmin /options DC_NAME (replace DC_NAME with your server's name). Look for any flags like DISABLE_OUTBOUND_REPL or DISABLE_INBOUND_REPL. If you see them, remove them with:

repadmin /options DC_NAME -DISABLE_OUTBOUND_REPL -DISABLE_INBOUND_REPL

2. Now check the replication status for the domain partition:

repadmin /showrepl DC_NAME /dc

If you see errors about a missing cross-ref object, we're on the right track. The simplest moderate fix is to set the domain controller's synchronization partner explicitly:

repadmin /syncall DC_NAME /AdeP

This forces a full sync. I've seen this fix about 30% of cases where the error just appeared after a reboot. If it doesn't clear, move on.

Advanced fix: Ntdsutil and ADSI Edit cleanup (15+ minutes)

This is the real fix when the crossRef object for the domain is missing or corrupted. You'll need to be logged in with Enterprise Admin credentials.

Step 1: Identify the missing crossRef

Open ADSI Edit. Connect to the Configuration partition (not Default naming context). Navigate to:

CN=Partitions,CN=Configuration,DC=yourdomain,DC=com

Look for the CN= object that matches your domain's DNS name. For example, if your domain is corp.example.com, you should see CN=corp. If it's missing, that's your problem.

Step 2: Create the missing crossRef

If the object is gone, you'll create it using ADSI Edit:

1. Right-click the CN=Partitions container and choose New > Object.
2. Select crossRef as the class.
3. Set these values (use your own domain info):
   • cn: your domain's NetBIOS name (e.g., CORP)
   • nCName: DC=corp,DC=example,DC=com
   • dnsRoot: corp.example.com
   • trustParent: CN=example,CN=Partitions,CN=Configuration,DC=example,DC=com (replace with your parent)
   • systemFlags: 3 (enables replication and GC)
4. Click Finish.

Step 3: Use ntdsutil to force a change

Open an elevated Command Prompt and run:

ntdsutil
metadata cleanup
connections
connect to server DC_NAME
quit
select operation target
list domains
select domain 0
quit
remove selected domain
quit
quit

This removes the orphaned domain reference. Then restart the Active Directory Domain Services service:

net stop ntds && net start ntds

Step 4: Verify

Run dcdiag /test:crossref /s:DC_NAME. You should see a pass. Also check event logs for event IDs 1925 or 1963—they should be gone.

I've used this fix on Windows Server 2008 R2 through 2019. On Server 2022, the steps are identical, but double-check that you're not dealing with a virtual domain controller clone issue—that's a different beast.

If you're still stuck after this, the problem might be deeper—like a forest trust that was deleted from the parent side without reciprocal cleanup. In that case, you'll need to either rebuild the trust from scratch or demote the DC and promote it again. But nine times out of ten, the crossRef trick works.

Hope this saves you the headache I had back in 2017 on a Server 2012 R2 box. You've got this.