Fix 0X0000219B SPN for Deleted Domain

When this error shows up

You're running a Windows Server 2019 or 2022 domain controller. Maybe you're demoting an old DC, or you're trying to replicate with a partner you thought you'd removed. Suddenly you see event ID 0X0000219B in the Directory Services log. The message reads: ERROR_DS_CANT_DERIVE_SPN_FOR_DELETED_DOMAIN.

This happens most often after someone forcefully removed a domain from the forest — maybe they deleted the domain object from Active Directory Sites and Services without going through the proper demotion process. Or you had a failed domain rename that left behind a ghost domain. Either way, the DC you're working on still has references to that deleted domain. When it tries to build a service principal name (SPN) for the domain, it can't because the domain's gone. So it throws 0X0000219B.

What's actually happening

Every domain in a forest has a crossRef object in the Configuration partition of Active Directory. That object tells DCs how to find the domain's naming context. When you delete a domain properly — using Active Directory Domains and Trusts — Windows cleans up that crossRef object, removes the domain's reference from the SPN mapping tables, and updates the msDS-SPNSuffix and msDS-DnsRootAlias attributes where needed.

But if you skip the proper removal — maybe you deleted the domain's OU or its DC objects manually — that crossRef entry stays. The remaining DC sees it, tries to generate SPNs for services like LDAP, Kerberos, or RPC using that domain's DNS name, and fails because the domain no longer exists in the forest trust table.

The error 0X0000219B is the Directory Services Agent saying: "I've got a reference to a domain I can't find, and I can't make a service ticket for it."

The fix: clean up orphaned metadata

You've got two approaches. I recommend the first: use ntdsutil to remove the stale domain reference from the Configuration partition. The second — manually deleting the crossRef object through ADSI Edit — works, but you risk missing related references. Let's do this the right way.

Identify the deleted domain. Open a command prompt as Administrator. Run:
```
repadmin /showattr . NC=head,CN=Schema,CN=Configuration,DC=yourdomain,DC=com /filter:"(cn=*)" /subtree /attribute:cn,dnsRoot
```
Scroll through the output. Look for a crossRef entry where dnsRoot points to a domain you no longer have. Write down the cn (common name) of that domain — it's usually the NetBIOS name.
Open ntdsutil. Still in the command prompt, type:
```
ntdsutil
```
Enter metadata cleanup. At the ntdsutil: prompt, type:
```
metadata cleanup
```
You'll see: metadata cleanup:
Connect to the server. Type:
```
connections
```
Then:
```
connect to server localhost
```
Hit Enter. You should see: Binding to localhost ... Connected to localhost using credentials of locally logged on user.
Quit the connections menu. Type:
```
quit
```
Back at metadata cleanup:
Select the stale domain. Type:
```
select operation target
```
Then at select operation target:, type:
```
list domains
```
You'll see a numbered list of all domains this DC knows about. Find the one that shouldn't be there. Note its number (say, 2).
Select that domain. Type:
```
select domain 2
```
Substitute 2 with the actual number. It should print the domain's DN.
Remove it. At select operation target:, type:
```
quit
```
Back at metadata cleanup:, type:
```
remove selected domain
```
You'll get a confirmation dialog: Are you sure you want to remove the domain object from the enterprise? Click Yes.
Quit ntdsutil. Type quit twice to exit back to the command prompt.
Force replication. Run:
```
repadmin /syncall /AdeP
```
This pushes the change to all DCs in your forest. Wait a minute or two, then check the event log.

What if the error persists?

Sometimes ntdsutil doesn't catch all the references. The deleted domain might still be listed in the msDS-SPNSuffix attribute on the Domain NC head or on the CN=Microsoft DNS,CN=System container. Here's what to check:

Open ADSI Edit. Connect to the Configuration partition (CN=Configuration,DC=yourdomain,DC=com). Expand CN=Partitions. Find any crossRef object with a cn matching the deleted domain. Right-click it and delete it.
Check the Domain NC head. In ADSI Edit, connect to the Domain NC (DC=yourdomain,DC=com). Right-click the root object, go to Properties. Look for msDS-SPNSuffix. If the deleted domain's DNS name appears there, remove it.
Check the DNS zones. Open DNS Manager. Look for a forward lookup zone named after the deleted domain. If it's there, delete it. Also clear the _msdcs folder under your forest root zone of any stale entries.

After cleaning those, run repadmin /syncall /AdeP again. Reboot the DC that logged the error. That usually stomps 0X0000219B for good.

One last thing: If you're seeing this error during a DC demotion — that is, you tried to demote a DC and it failed with 0X0000219B — then the problem is almost certainly on the DC you're demoting. It has a reference to a domain that's already been deleted from the forest. In that case, run ntdsutil on the DC you're trying to demote, not on a different one. Then retry the demotion.