Quick answer
Run repadmin /showrepl to find which domain controller has the stale alias, then use ADSI Edit to delete the orphaned alias reference. The alias's objectClass is usually group with a member attribute pointing to a deleted object's GUID.
What's actually happening here
This error crops up when Active Directory tries to resolve a group alias (like a distribution group or a security group) and hits a member attribute that references an object that's been deleted. The alias itself still exists, but one of its members no longer does. Think of it as a phone number in your contacts that points to a disconnected line — the directory service can't complete the lookup.
The trigger is usually a failed domain controller replication or a partial object deletion where the cleanup process didn't fully remove the member reference. You'll see this error in event logs, LDAP queries, or when trying to modify group membership through tools like Active Directory Users and Computers. The exact error text reads: “The alias cannot be dereferenced.”
Don't confuse this with a missing forward link scenario — what's happening is the backlink (the alias reference) is stale, and the directory service doesn't know how to resolve it because the target object's tombstone has expired or the object was force-deleted without proper propagation.
Fix steps
- Identify the broken alias — Open Event Viewer and look under
Directory Servicefor events with ID 1644 or 1655 that mention 0x2091. The event details will list the distinguished name (DN) of the alias that's failing. If you don't see the event, runrepadmin /showrepl * /csvon a domain controller and grep for “2091” or “CANT_DEREF”. - Find the offending member reference — Use
ntdsutilor ADSI Edit. Open ADSI Edit, connect to the domain naming context, and navigate to the alias's DN from step 1. Right-click the object, choose Properties, and look at thememberattribute. You'll see one or more DNs with aCN=Deleted Objectscontainer parent — those are the broken references. - Remove the stale member entry — In ADSI Edit, double-click the
memberattribute, select the broken DN (the one pointing toCN=Deleted Objects), and click Remove. If the attribute is multi-valued, remove only the bad values. Click OK to save. - Force replication — On the domain controller you edited, run
repadmin /syncall /AdeP. This pushes the change to all other DCs. Wait a few minutes, then check event logs for disappearance of the 0x2091 errors. - Verify resolution — Query the alias with
ldapsearch -b "CN=Users,DC=yourdomain,DC=com" "(distinguishedName=. You should no longer see the deleted object's DN in the results.)" member
Alternative fixes if the main one fails
If ADSI Edit can't remove the member reference because the alias object itself is corrupted, use the dsmod group command from an elevated command prompt:
dsmod group "CN=BrokenGroup,OU=Groups,DC=yourdomain,DC=com" -rmmbr "CN=DeletedUser\0ADEL:long-guid-here,CN=Deleted Objects,DC=yourdomain,DC=com"You'll need the exact DN of the deleted object. Get it from the member attribute in step 2. If that also fails, consider using ldp.exe to directly modify the attribute — connect to the DC, bind as an admin, open the alias's DN, and delete the bad multi-valued member entry through the Attribute Editor pane. I've seen this work when ADSI Edit refused due to permission quirks.
Worst case: if the alias group itself is broken beyond repair (e.g., all members are stale), delete it with dsrm and recreate it fresh. Only do this if you know the correct membership list from backup.
Prevention tip
Enable the tombstone lifetime quota and never force-delete user accounts or groups without removing them from all group memberships first. Use the Remove-ADGroupMember PowerShell cmdlet before deleting an object. Also, run a monthly cleanup script that scans for member attributes pointing to deleted objects — Get-ADGroup -Filter * -Properties member | Where-Object {$_.member -match "Deleted Objects"} catches these before they cause errors during replication or LDAP queries.