Fix ERROR_DS_CONFIG_PARAM_MISSING (0x000020EB) in Active Directory

Yeah, this error is a real kick in the teeth. Your domain controller won't start, DCPROMO fails, or you get a cryptic 0x000020EB when trying to promote a new DC. I've seen this across Windows Server 2012 R2, 2016, and even 2022. Let's get it fixed.

The Quick Fix: Restore the Missing Registry Key

This error almost always means the HKLM\System\CurrentControlSet\Services\NTDS\Parameters key is missing or corrupted. Here's how to fix it:

1. Open Regedit as Administrator.
2. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS.
3. If the Parameters subkey is missing, right-click NTDS, choose New > Key, and name it Parameters.
4. Now create a DWORD (32-bit) value named ServiceDLL. Set its value to:

   C:\Windows\System32\ntdsai.dll

5. Create another DWORD named SystemSubset and leave it as 0.
6. Create a REG_SZ (string) value named Database Backup Path. Set it to C:\Windows\NTDS.
7. Create a REG_SZ value named Database Log Files Path. Set it to C:\Windows\NTDS.
8. Create a REG_SZ value named Database Working Directory. Set it to C:\Windows\NTDS.
9. Close Regedit and restart the Active Directory Domain Services (NTDS) service. Or just reboot the server.

That's it. 90% of the time, this gets the DC back up. Had a client last month whose entire print queue died because of this — they'd accidentally deleted the NTDS key while cleaning up old printer drivers. Yep, it happens.

Why This Works

The NTDS\Parameters key stores the paths and DLL references that the Directory Service needs to load. Without it, AD doesn't know where to find its database files or its core engine (ntdsai.dll). The error 0x000020EB is literally saying "I can't find my configuration parameter."

Most common triggers:

• Someone manually editing or deleting registry keys (oops).
• Corrupted system restore that nuked the key.
• Malware that targeted registry entries (rare but seen).
• A failed Windows update that didn't roll back cleanly.

The fix restores the minimum set of values AD needs to start. Once the service runs, it re-creates the rest of the parameters automatically. You don't need to add every single subkey — AD is smart enough to fill in the blanks once it's running.

Less Common Variations

Sometimes the key exists but a specific value is missing. Here's what I've seen:

Also check if the NTDS folder actually exists at C:\Windows\NTDS. If it's gone, create it. One client had a server where someone moved the folder to a different drive but forgot to update the registry.

Pro tip: If you're running a virtualized DC, snapshot the VM before doing registry edits. I've seen a bad regedit take down a domain for an afternoon. Don't be that guy.

Prevention

You don't want to fix this twice. Here's how to keep it from happening:

• Back up the registry regularly. Export HKLM\System\CurrentControlSet\Services\NTDS after every patch Tuesday. Store it on a network share.
• Use Group Policy to restrict registry editing. Only Domain Admins should be able to edit the NTDS key.
• Enable auditing for registry changes. Track changes to HKLM\System\CurrentControlSet\Services\NTDS with Advanced Audit Policy under Object Access > Audit Registry.
• Run regular system state backups. If the registry gets corrupted, you can restore just the system state without re-promoting the DC.
• Never use a registry cleaner on a domain controller. Those tools often delete keys they shouldn't. I've seen DCs bricked by CCleaner and similar apps.

That's it. Fix the key, restart, and you're back in business. Don't overthink it — this is a mechanical issue, not a deep AD problem. If the fix doesn't work, check for deeper corruption in the NTDS database with ntdsutil or consider a metadata cleanup and re-promotion.