Fix ERROR_DS_CANT_REM_MISSING_ATT_VAL 0X00002085

Yeah, this error is a pain because it makes no sense at first. You're trying to remove an attribute value, and Windows is telling you it doesn't exist. But you can see it right there in the property editor. Trust me, I've been there. Here's the fix.

The Fastest Fix: Use ADSI Edit to Force-Remove the Value

You'll need to be a Domain Admin or have equivalent rights. This isn't something a regular helpdesk account can do.

1. Open ADSI Edit (if it's not installed, add it via Server Manager > Tools > ADSI Edit, or install the RSAT tools).
2. Right-click ADSI Edit in the left pane and choose Connect to.
3. In the dialog, make sure Naming Context is set to Default Naming Context. Click OK.
4. Drill down to the object that's throwing the error. If you know the distinguished name, you can type it in the path box. Otherwise, expand the domain, then the OUs until you find it.
5. Right-click the object and select Properties.
6. In the Attribute Editor tab, find the attribute listed in the error. Click it once, then click Clear.
7. If the Clear button is greyed out, click Edit instead, then in the String Attribute Editor, delete the value manually and hit OK. Don't worry if it looks empty already—the point is to force the write.
8. Click Apply and then OK.

After you hit Apply, you should see the attribute now shows <not set> or disappears from the list. That's your cue that the fix worked.

Why This Works

The error 0x00002085 means the LDAP delete operation is trying to remove a value that the directory doesn't have recorded. That usually happens when replication is out of sync—one domain controller still has an old value marked for deletion, but another one already processed it. Or, someone (or some script) manually deleted the value outside of normal AD tools, leaving a lingering reference.

ADSI Edit forces a direct write to the attribute, bypassing the normal delete filter. Instead of saying "delete this exact value," it just clears whatever is there, which is enough to reset the state and stop the error from popping up.

PowerShell Alternative (If You Prefer Command Line)

If you're on Server 2016 or newer with AD PowerShell module, you can do the same thing without clicking around. Run PowerShell as admin and use the Set-ADObject cmdlet:

Set-ADObject -Identity "CN=John Doe,OU=Users,DC=contoso,DC=com" -Clear "attributeName"

Replace attributeName with the actual attribute, like extensionAttribute3. This removes the value completely.

Less Common Variations

Error Appears During a Script or PowerShell Command

If you're getting this while running a script that removes an attribute, it means the script is trying to remove a value that can't be found. Check the script's logic—maybe it's processing an object that was already modified. Add a check to see if the attribute exists before attempting deletion:

if (Get-ADObject -Identity $objectDN -Properties $attrib -ErrorAction SilentlyContinue) {
    Set-ADObject -Identity $objectDN -Clear $attrib
}

Error in AD Replication Status

Sometimes you'll see this in repadmin output. The real fix there is to trigger a replication check with repadmin /replsummary and then force replication between the affected DCs:

repadmin /syncall /AdeP

If that doesn't clear it, the attribute is stuck on a specific DC. Connect ADSI Edit to that DC directly (choose Select or specify a domain or server in the connection dialog) and clear the attribute there.

Prevention Tips

• Don't delete AD attributes manually with raw LDAP tools unless you know what you're doing. Use ADUC or PowerShell cmdlets.
• Monitor replication health regularly. Use repadmin /replsummary weekly to catch issues before they snowball.
• If you're automating attribute changes, always check if the attribute exists before trying to remove it. Scripts that blindly delete will trigger this error.
• Keep all DCs on the same AD schema version. Mixed versions can cause weird replication quirks.

Most of the time, clearing the attribute once fixes it for good. If it comes back, you've got a replication loop, and that's a deeper problem—start checking for tombstones and lingering objects.