Fix 0X000020E3 DSA Object Not Found in Active Directory

This error means Active Directory can't find a Domain Controller's DSA object. It usually happens after a failed replication or a DC tombstone cleanup.

Quick answer

Run ntdsutil metadata cleanup to remove the dead Domain Controller from the configuration partition, then force replication with repadmin /syncall.

What's going on here?

You're getting ERROR_DS_CANT_FIND_DSA_OBJ (0X000020E3) when trying to replicate Active Directory. The DSA object is the server's representation in the configuration partition (CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=yourdomain,DC=com). If a Domain Controller (DC) was forcefully removed — maybe you demoted it badly, or it died — the reference is still there but the actual object is gone or orphaned. Replication tries to find that object and fails with this error.

I've seen this most often after someone runs dcpromo /forceremoval without cleanup, or after restoring a DC from backup without proper metadata cleanup. It also pops up when you try to replicate to a DC that was tombstoned and then re-promoted with the same name.

Fix steps — main method

Open a Command Prompt as Administrator. Don't skip this — right-click and pick "Run as administrator".
After you click that, you should see a black window with Administrator in the title bar.
Start ntdsutil. Type ntdsutil and press Enter.
The prompt changes to ntdsutil:. That means you're in.
Go to metadata cleanup. Type metadata cleanup and press Enter.
You'll see metadata cleanup:.
Connect to a working DC. Type connections and press Enter. Then type connect to server <working-DC-name> (use the actual name of a good DC, like DC01). Press Enter. Then type q and press Enter to go back.
You should see a message that says "Binding to ... connected." If it fails, check your DNS — this error loves bad DNS.
Select the problematic server. At the metadata cleanup: prompt, type select operation target and press Enter. Then type list sites and press Enter. You'll see a list of sites. Type select site 0 (or the correct number) and press Enter. Then type list servers in site and press Enter. Find the dead DC in the list. Type select server <number of dead DC> and press Enter.
After selecting, type q twice to go back to metadata cleanup:.
Remove the selected server. Type remove selected server and press Enter. Confirm with Yes.
You'll get a message like "Removal completed successfully." If you get an error, the DC might still be alive — check if it's really dead first.
Run repadmin to force replication. Type repadmin /syncall /AdeP and press Enter.
You should see replication events completing without the 0X000020E3 error. If you still see it, you missed a dead DC somewhere.

Alternative fix if the main method fails

If ntdsutil fails because of permission issues or the dead server is still partially alive, you can use ADSI Edit to manually delete the orphaned server object.

Open ADSI Edit (add it from Server Manager if you don't have it).
After opening, you'll see a blank console.
Connect to the Configuration partition. Right-click "ADSI Edit" in the left pane, pick "Connect to...", then in "Select a well known Naming Context", pick "Configuration". Click OK.
You should see a tree expand under CN=Configuration,DC=yourdomain,DC=com.
Navigate to the dead server. Expand CN=Sites, then CN=Default-First-Site-Name (or your site), then CN=Servers. Find the server name that matches the error. Right-click it and pick Delete.
Confirm the deletion. That object is now gone.
Run dcdiag /test:replications to verify.
You should see "passed test Replications" with no errors.

Warning: Deleting the wrong server object can break replication for that DC. Only delete if you're 100% sure it's dead and not coming back.

Prevention tip

Before demoting any DC, always use Server Manager to remove the Domain Controller role or run dcpromo /unattend with the right answer file. Never use /forceremoval unless the server is physically gone. If a DC fails and you can't demote it properly, run metadata cleanup within 24 hours. After that, tombstone cleanup gets messy and you end up with this error. Keep your DNS records clean too — stale DC records are the #1 cause of this mess.