Fix ERROR_DS_ALIAS_DEREF_PROBLEM (0X00002034)

Quick answer

Run repadmin /showobjmeta . "CN=Alias,CN=Schema,CN=Configuration,DC=domain,DC=com" to find the broken alias entry, then delete it with ADSI Edit — or set referral chasing to "never" in your LDAP client.

What's actually happening here

ERROR_DS_ALIAS_DEREF_PROBLEM (0X00002034) means your LDAP client asked the server to follow an alias (a CN object with objectClass: alias) during a search, but that alias points to a target object that doesn't exist or is inaccessible. Think of it like a symlink on Linux that points to a deleted file — the link itself is there, but the destination is gone.

I see this most often when someone manually edited Active Directory schema objects or moved objects between OUs without updating alias references. It also pops up when an LDAP application (like an old mail server or monitoring tool) has LDAP_OPT_DEREF set to LDAP_DEREF_ALWAYS and hits a stale alias. The error code 0x2034 maps to DSA_ALIAS_DEREF_PROBLEM in winerror.h, and it's a bloody specific one — you're not dealing with a generic connectivity issue.

Fix steps

Identify the broken alias — Open Event Viewer on your domain controller and look for a source "NTDS" or "ActiveDirectory_DomainService" event with ID 1126 or 1644. The message usually includes the alias DN. If no event logged, enable diagnostic logging:
```
reg add HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics /v 16  Field Engineering /t REG_DWORD /d 2
```
Re-run the failing operation, then check Event Viewer again.
Find the exact alias container — Once you have the DN, use ADSI Edit to connect to the Configuration naming context. Navigate to CN=Schema,CN=Configuration,DC=yourdomain,DC=com. Look for objects where objectClass equals alias. If the DN shows a container like CN=Alias,CN=Schema,CN=Configuration,..., that's your culprit.
Check the alias target — Right-click the alias object, select Properties. Find the attribute objectClass — it should show alias. Then find serverReference or friendlyNames (depends on what type of alias). The target DN there is what the server tries to resolve. Verify that object exists. If not, that's why you're seeing the error.
Delete the alias — If the alias serves no purpose (and it probably doesn't, since it's pointing to nowhere), delete it in ADSI Edit. Right-click, Delete. Confirm. Wait for replication. repadmin /syncall to force it if you're in a hurry.
Test the operation — Run whatever LDAP search or application command failed before. Should go through now.

Alternative fix: tweak referral chasing

If you can't delete the alias (maybe it's from a vendor product you can't touch), change your LDAP client's dereference behavior. In most LDAP libraries, you set LDAP_OPT_DEREF to LDAP_DEREF_NEVER. For example in .NET's DirectorySearcher:

DirectorySearcher searcher = new DirectorySearcher(); searcher.ReferralChasing = ReferralChasingOption.None;

Or in Python ldap3:

from ldap3 import Server, Connection, AUTO_BIND_NO_TLS, DEREF_NEVER
server = Server('dc01.domain.com', get_info=ALL)
conn = Connection(server, auto_bind=AUTO_BIND_NO_TLS, client_strategy=SAFE_SYNC)
conn.deref = DEREF_NEVER

This stops the client from asking the server to dereference aliases. The search will skip aliases entirely, avoiding the error.

Why step 4 works

Deleting the alias removes the LDAP entry that triggers the dereference attempt. The server no longer tries to follow it, so the error vanishes. The reason the error only shows up during a search (and not when you simply read the alias object) is that dereferencing only happens when you set the deref flag — most LDAP viewers don't bother.

Prevention tip

Don't manually edit the Schema container unless you absolutely have to. If you do, always check that any alias you create has a valid target by running dsquery * "targetDN" first. Also, avoid using LDAP_DEREF_ALWAYS in application code — use LDAP_DEREF_NEVER unless you really need to follow aliases. Most apps don't.

This error is rare but nasty when it hits. You'll usually see it after an AD schema upgrade or a failed domain controller promotion that left half-baked alias objects.