Fix 0x0000212B: Active Directory cross-domain cleanup error

What you're seeing

Your domain controller logs throw ERROR_DS_CROSS_DOMAIN_CLEANUP_REQD with code 0x0000212B. The event says something like "the directory service cannot perform cleanup of cross-domain objects." Had a client last month whose whole domain replication stopped because of this.

Basically, your AD tried to delete or update an object that references another domain, and that domain isn't talking back. Could be a dead domain controller, a broken trust, or leftover metadata from an old decommission.

Let's fix it in three steps — stop when the error goes away.

Fix 1: Quick restart (30 seconds)

Sometimes the error is just a glitch. The domain controller lost sync with a partner temporarily. Restart the NetLogon service or reboot the whole server.

1. Open Command Prompt as admin.
2. Type net stop netlogon && net start netlogon and hit Enter.
3. Check event logs again. If the error is gone, you're done.

If it sticks, move on. Had a small office where this worked once — a network hiccup cleared after restart.

Fix 2: Check domain trust (5 minutes)

The error often means one domain can't talk to another. Verify the trust is healthy.

1. Open Active Directory Domains and Trusts from Server Manager or Admin Tools.
2. Right-click your domain, select Properties, then the Trusts tab.
3. For each trust listed, click it and hit Verify. Enter credentials for the other domain when asked.
4. If verification fails, note the trust that broke. You'll need to remove and recreate it.

If trust is dead:

1. Right-click the broken trust in the list, choose Remove.
2. On the other domain controller, do the same from its end.
3. Recreate the trust by right-clicking your domain, New Trust, and run the wizard.
4. Re-verify after creation.

After fixing the trust, reboot the domain controller. Check event logs. Still there? Go to the advanced fix.

Fix 3: Remove stale metadata (15+ minutes)

If trust is fine, you've got leftover metadata from a domain controller that was removed without proper cleanup. This is common when someone just deleted the server without running dcpromo or using Server Manager to remove AD DS.

Use ntdsutil. But careful — you can wreck your AD if you mess this up.

1. Open Command Prompt as admin.
2. Type ntdsutil and press Enter.
3. Then metadata cleanup and Enter.
4. Then connections and Enter.
5. Type connect to server [your own DC name] — substitute your actual DC name, like connect to server DC01.example.com.
6. Type quit to go back.
7. Type select operation target and Enter.
8. Type list domains. You'll see domain numbers.
9. Find the domain that the error references. Type select domain [number].
10. Type list sites, find the site if needed, select it.
11. Type list servers in site. Look for a server that shows as "removed" or has a question mark. Select it with select server [number].
12. Type quit twice to get back to metadata cleanup prompt.
13. Finally, type remove selected server and confirm.

After that, exit ntdsutil (quit then quit again). Reboot the DC. Check event logs — the 0x0000212B should be gone.

If nothing works

Sometimes the error hides deeper — corrupted AD database or replication issues. Run repadmin /replsum to see any lingering replication failures. If you see failures, fix replication first. Last resort: restore from backup of a good DC.

Got a tricky case? Drop me a line. I've seen this enough times to know it's rarely a hardware problem.