Fix 0X00002129: Can't Move Deleted AD Object Across Domains

Quick answer

Run repadmin /rehost or repadmin /remove on the source domain controller to force it to acknowledge the object's tombstone state, then retry the move.

What's going on

This error means you're trying to move an Active Directory object (user, group, computer) from one domain to another, but the destination domain controller already has a tombstone record for that object. The object's GUID matches one that was deleted earlier, and the destination server won't accept the move because it thinks the object should stay dead. This usually happens after a failed move attempt or a partial replication cycle that left the object in a weird state. The real fix isn't to recreate the object—it's to sync the tombstone metadata across both sides.

I've seen this most often when someone tries to do an inter-domain move using Active Directory Users and Computers (ADUC) or PowerShell's Move-ADObject, and the source domain hasn't fully replicated the deletion status. The error code 0X00002129 maps to ERROR_DS_CANT_MOVE_DELETED_OBJECT. Windows Server 2016, 2019, and 2022 all behave the same way here—there's no version-specific workaround.

Fix steps

Identify the object's GUID — On any domain controller, open PowerShell as admin and run:

Get-ADObject -Filter {DistinguishedName -eq "CN=JohnDoe,OU=Users,DC=source,DC=local"} -Properties objectGUID | Format-List Name, objectGUID

Write down the GUID. You'll need it.

Check replication status — Run:
```
repadmin /showrepl
```
Look for the source domain controller (the one you're connected to) and the destination domain controller. If you see any replication failures, fix those first. After you fix failures, wait 15 minutes and check again.
Force the source to tombstone the object — On the source domain controller (the one where the object still appears alive), open a CMD as admin and run:
```
repadmin /options +DISABLE_OUTBOUND_REPL
```
This stops replication from the source. Then delete the object manually using ADUC or Remove-ADObject. After deletion, run:
```
repadmin /syncall /AdeP
```
This forces a replication cycle. After it finishes, run:
```
repadmin /options -DISABLE_OUTBOUND_REPL
```
Clean up lingering tombstone on destination — On the destination domain controller, open CMD as admin and run:
```
repadmin /remove /all
```
This removes all cached replication data for this object. Then run repadmin /syncall again. The destination should now have the tombstone state.
Recreate and move the object — On the source domain, create the object fresh (same name, same attributes) using PowerShell or ADUC. Then use Move-ADObject to move it across domains. It should work now.

Alternative fixes if the main one doesn't work

Use authoritative restore — If repadmin steps fail, boot the destination domain controller into Directory Services Restore Mode (DSRM). Run ntdsutil, go to "authoritative restore", restore the object from a backup before it was deleted. Then reboot normally. This overrides the tombstone, but you'll need a recent backup.
Delete and recreate on the destination side — If the move isn't critical, delete the object everywhere (source and destination) using ADSI Edit. Wait 60 minutes for garbage collection (default tombstone lifetime is 60 days, but after deletion, the object gets purged). Then recreate the object directly in the destination domain. This skips the move entirely.
Increase tombstone lifetime — Not a fix, but a workaround: if you're in a hurry, you can shorten the tombstone lifetime temporarily (not recommended in production). Default is 60 days. Changing it to 2 days accelerates cleanup, but breaks replication if you have other DCs. Don't do this unless you know what you're doing.

Prevention tips

Before you move an object across domains, always check its replication status first. Run repadmin /showobjmeta on both sides to make sure the object hasn't been partially deleted. If you see any tombstone flags, clean those up before attempting the move. Never move an object that's been involved in a failed cross-domain move within the last 24 hours—the tombstone metadata hangs around longer than you'd expect. Also, keep your replication schedule tight (15 minutes or less) to reduce the window for these conflicts. If you're doing bulk moves, script it with a 10-minute pause between each object to let replication catch up.