Fix AD error 0x000021B2 invalid search flag subtree

What this error means and when you'll see it

Error 0x000021B2 (ERROR_DS_INVALID_SEARCH_FLAG_SUBTREE) shows up when you're creating or modifying an Active Directory attribute and the searchFlags value has bit 1 (0x2) set incorrectly. Bit 1 tells AD to index the attribute for subtree searches — but if the attribute's schema definition doesn't support it, or the bit is set on a non-searchable attribute, AD throws this error.

I've seen this mostly in two places:

When someone extends the schema with a custom attribute and blindly copies searchFlags from another attribute.
When an application (like Exchange or Lync) tries to modify searchFlags during installation and hits an attribute that already has the wrong value.

You'll likely see it in the event log — source NTDS or ActiveDirectory_DomainService — or as a pop-up in ADSI Edit when you try to save changes.

What you'll need before starting

Domain admin credentials or equivalent rights to modify the schema.
A test domain controller. Don't mess with the schema on a production DC unless you've tested this first.
ADSI Edit installed (it's part of Remote Server Administration Tools on Windows Server 2008 R2 and later).
The exact name of the attribute that's causing the error. You can find it in the event log details or by running the command in Fix 3.

Fix 1 (30 seconds): Restart the Domain Controller — quick reset

This is a long shot, but it's the fastest check. Sometimes the schema cache on a single DC gets stale and the error is a false positive after a schema update.

Open a command prompt as administrator.
Type: shutdown /r /t 0
After the DC reboots, check if the error reappears (look in Event Viewer under Applications and Services Logs > Directory Service).

Expected outcome: If the error was due to a cached schema version, it'll be gone. If it comes back within a few minutes, move to Fix 2.

Fix 2 (5 minutes): Clear the subtree search flag using ADSI Edit

This is the real fix most of the time. You're going to remove bit 1 (value 2) from the searchFlags attribute on the problematic schema object.

Open ADSI Edit. If it's not installed, add it via Server Manager > Add Roles and Features > RSAT > AD DS and AD LDS Tools.
Right-click ADSI Edit in the left pane and choose Connect to...
In the Connection Settings dialog, under Select a well-known Naming Context, choose Schema. Click OK.
In the tree, expand CN=Schema,CN=Configuration,... then scroll down to find the attribute that's throwing the error. It'll be listed by its cn name (like myCustomAttribute).
Right-click that attribute, choose Properties.
Find the searchFlags attribute in the list. Double-click it. Write down the current value — you'll need it to calculate the correct new value.
Look at the current value. If it's an odd number, it includes bit 0 (indexed). If it's even, bit 0 is off. Bit 1 is the subtree flag. You need to subtract 2 from the current value if the current value is 2 or more. For example:
- Current value 3: subtract 2 → new value 1 (keeps bit 0, removes bit 1).
- Current value 2: subtract 2 → new value 0 (removes bit 1, no other flags).
- Current value 7: subtract 2 → new value 5 (keeps bits 0 and 2, removes bit 1).
Enter the new value and click OK.
Click Apply (you should see the value update). Then click OK to close the properties window.
Close ADSI Edit.

Expected outcome: The error should stop immediately. If you still see it after a few minutes, the schema cache hasn't refreshed. Run repadmin /syncall /AdeP on the DC to force replication, then restart the Active Directory Domain Services service.

Fix 3 (15+ minutes): Use repadmin to find and fix the attribute across all DCs

If Fix 2 worked but the error keeps coming back (maybe another DC is replicating the bad value), or if you can't identify the attribute from the event log, this approach cleans it everywhere.

Open an elevated command prompt on any DC.
Run this command to find attributes with the subtree flag set (this searches the schema partition):
```
repadmin /showattr . "CN=Schema,CN=Configuration,DC=yourdomain,DC=com" /filter:"(searchFlags:1.2.840.113556.1.4.803:=2)" /atts:cn,searchFlags
```
Replace DC=yourdomain,DC=com with your actual domain DN. For a domain contoso.com, it's DC=contoso,DC=com.
The output lists all attributes where bit 1 is set. Look for the attribute name that matches the error. Write down its cn and the current searchFlags value from the output.
Now you need to fix each one. Use LDAP modify. Create a text file called fix.txt with this content (replace attributeName and the new flags value):
```
dn: CN=attributeName,CN=Schema,CN=Configuration,DC=yourdomain,DC=com
changetype: modify
replace: searchFlags
searchFlags: newValue
-
```

Run this command to apply the fix:

ldifde -i -f fix.txt -s localhost -j . -c "CN=Schema,CN=Configuration" "#configurationNamingContext"

Wait for replication. Run repadmin /syncall /AdeP on each DC.
Finally, restart the Active Directory Domain Services service on each DC. You can do this remotely with:
```
net stop ntds /y && net start ntds
```

Expected outcome: After replication and service restart, the error should be gone. Verify by checking the event log for any new instances of 0x000021B2.

When to call Microsoft Support

If you've done Fix 3 and the error persists, you might be dealing with a corrupted schema object or a bug in a specific application that's writing the flag incorrectly. In that case, open a support ticket with Microsoft. They'll have you capture a network trace to see which process is setting the flag.

One last tip

I've seen administrators set the subtree flag on attributes like displayName or givenName thinking it'll speed up searches. It doesn't. Subtree indexing is only useful for linked attributes (like member in groups). Otherwise, it wastes space in the index and can cause this exact error. Leave searchFlags alone unless you really know what you're doing.