Fix 0X00002094: DSA Object Won't Delete

It's maddening when you're trying to clean up a dead domain controller and Active Directory just says no. You've demoted the server, it's offline, but the DSA object under the NTDS Settings won't budge. The error 0X00002094 pops up and you're stuck. Don't worry – this is a metadata cleanup problem, and we can fix it in about ten minutes.

What Causes This Error

This error shows up when you try to delete a domain controller object from AD Sites and Services or AD Users and Computers, but the system still thinks that DC is alive. Usually it's because you force-demoted the server or it died before completing a graceful demotion. The DSA object – which is the directory system agent for that DC – still has lingering references in the configuration partition. AD won't let you delete it until those references are cleaned.

I see this most often after someone runs dcpromo /forceremoval on a server and then tries to delete the leftover computer account. The metadata stays behind and blocks the deletion.

The Quick Fix: Metadata Cleanup with ntdsutil

This is the official Microsoft-supported way. You'll run this from any domain controller or a machine with RSAT tools installed. Doesn't matter if it's Server 2012 R2, 2016, 2019, or 2022 – the command syntax is the same.

Open Command Prompt as Administrator. Click Start, type cmd, right-click it and pick Run as administrator.
Type ntdsutil and press Enter. You'll see the ntdsutil prompt.
Type metadata cleanup and press Enter.
Type connections and press Enter.
Type connect to server YourDomainControllerName. Replace YourDomainControllerName with the DNS name of a working DC. Example: connect to server DC01.contoso.com. Press Enter. You should see Binding to DC01.contoso.com ... Connected to DC01.contoso.com using credentials of locally logged on user.
Type quit and press Enter. You're back in the metadata cleanup menu.
Type select operation target and press Enter.
Type list domains and press Enter. You'll see a numbered list of domains in your forest.
Type select domain number where number matches the domain containing the dead DC. Press Enter.
Type list sites and press Enter. Find the site for the dead DC.
Type select site number and press Enter.
Type list servers in site and press Enter. You'll see all DCs in that site, including the dead one.
Type select server number with the dead DC's number. Press Enter.
Type quit and press Enter. Back to metadata cleanup.
Type remove selected server and press Enter. Confirm when prompted. You should see Removing entry ... Operation completed successfully.
Type quit twice to exit ntdsutil.

Now go back to AD Sites and Services and try deleting the NTDS Settings object again. It should work this time. If you still see the error, reboot the DC you're connected to and try again – rarely needed but sometimes the AD cache needs a kick.

Why This Works

ntdsutil's metadata cleanup removes all references to the dead DC from the configuration partition – that's the part of AD that holds the topology and naming contexts. Without this step, AD still thinks the DC exists and refuses to let you delete the DSA object because it's the root for that server's replica. The remove selected server command scrubs those references cleanly. It's the difference between ripping out a weed by the roots versus just breaking off the leaves.

Alternative: ADSI Edit When ntdsutil Won't Cooperate

Sometimes ntdsutil throws an error like Unable to locate the server or the dead DC's name doesn't appear in the list at all. That usually means the server object is already partially deleted or the AD replication is so broken that ntdsutil can't see it. In that case, use ADSI Edit.

Open ADSI Edit from Administrative Tools. If it's not installed, add the AD DS and AD LDS Tools feature via Server Manager.
Right-click ADSI Edit in the console tree and pick Connect to.
For Connection Point, pick Select a well-known Naming Context and choose Configuration. Click OK.
Expand the tree: CN=Configuration,DC=yourdomain,DC=com → CN=Sites → CN=YourSite → CN=Servers → CN=DeadServerName → CN=NTDS Settings.
Right-click the CN=NTDS Settings object and choose Delete. Confirm the deletion. You'll see a warning about deleting a DSA object – ignore it and click Yes.
Now right-click the dead server's container (the one above NTDS Settings) and delete that too.
Go to CN=Computers or CN=Domain Controllers in the domain naming context and delete the computer account for that server.

After that, run repadmin /replsum to verify replication is healthy. If you see errors, force replication with repadmin /syncall.

Less Common Twists

I've seen cases where the error appears because the DC you're trying to delete is also the last global catalog in the forest. AD won't let you remove it until you promote another GC. Check the Global Catalog checkbox in the NTDS Settings properties of another DC. Wait for replication – usually 15 minutes – then try the deletion again.

Another rare one: the dead DC held an FSMO role that wasn't transferred. Even after metadata cleanup, the leftover role reference can block deletion. Run netdom query fsmo from an elevated prompt. If the dead DC appears in the list, seize the role to a live DC using ntdsutil's roles – connections – connect to server – quit – seize rolename.

How to Prevent This

The real fix is prevention. Never force-demote a domain controller unless absolutely necessary. Always run the demotion wizard properly – in Server 2019 and later it's under Remove Roles and Features in Server Manager. If you need to force-demote because the server is physically dead, immediately run metadata cleanup before anyone tries to manually delete objects. The longer you wait, the more references can pile up.

Also, keep a list of your DCs and their roles. If a server fails, you can seize roles and clean metadata within minutes. A quick check with repadmin /showrepl every quarter will also flag orphaned references early. Trust me – spending ten minutes on cleanup now saves hours of head-scratching later.