Fix 0X000021A4 Domain Rename Error (Quick Steps)

This error appears when a domain rename operation is stuck. You'll clear the pending state, wait for replication, or force remove the stale reference. Real fix depends on whether the rename actually completed.

Quick answer

Run netdom query fsmo to confirm which DC holds the domain naming master, then on that DC use repadmin /syncall /AdeP to force replication. If that doesn't clear it, check the registry value HKLM\System\CurrentControlSet\Services\NTDS\Parameters\DsaPreviousDomain — remove it if present, then reboot.

If you're seeing ERROR_DS_DOMAIN_RENAME_IN_PROGRESS (0X000021A4) on a domain controller during a domain rename operation, it means the directory service is still in the middle of a rename that never finished. This usually happens when the rename process is interrupted — maybe the server rebooted mid-step, or a replication failure stopped the state from propagating. The DSA (Directory System Agent) is holding a flag that says "rename in progress", and until that flag is cleared, you can't perform any other domain-wide operations like adding a DC or applying a schema update.

I've seen this most often after someone runs rendom /execute and then loses network connectivity to the domain naming master. The state machine gets stuck, and every DC that tries to contact the domain naming master gets this error. The fix isn't complicated, but you need to be methodical — skip the easy checks and you'll waste hours.

Fix steps

Identify the domain naming master. Open an elevated command prompt on any DC and run netdom query fsmo. Look for the line that says "Domain naming master" — note the server name. All steps 2–5 happen on that server.
Check replication health. Still on that DC, run repadmin /replsummary. If you see failures, fix replication first. A stuck rename often blocks replication, so you might need to force it. Run repadmin /syncall /AdeP to push changes to all partners. Wait a few minutes, then re-run the summary. You want zero errors.
Look for a stale registry flag. Open regedit and go to HKLM\System\CurrentControlSet\Services\NTDS\Parameters. Look for a value named DsaPreviousDomain. If it exists, that's your stuck flag. Right-click it and delete it. Don't touch anything else in that key.
Reboot the domain naming master. After deleting the value, restart the DC. This is mandatory — the NTDS service reads this at startup, and a simple service restart often doesn't reload it. After reboot, open Event Viewer and look for NTDS event 2047 or 2048. If you see either, the flag is cleared.
Verify the fix. Run dcdiag /test:replications on that DC. Then try the operation that originally failed (like creating a new domain or running rendom /list). If you get no error, you're done.

Alternative fixes if the main one fails

Sometimes deleting the registry value isn't enough because the rename state is also stored in the directory itself. Here's what to try next:

Force replication of the partition. The rename state lives in the Domain Naming Context. Run repadmin /syncall /AdeP on every DC, not just the master. If you have a DC that's been offline, bring it up and let it replicate before proceeding.
Use rendom /abort. If you still have the rendom.exe file from the original rename attempt, run rendom /abort on the domain naming master. This tells the system to roll back the rename entirely. You'll lose the new domain name, but you'll be back to a clean state.
Seize the domain naming master role. If the current master is unreachable or keeps failing, force the role to another DC. Run ntdsutil, then roles, then connections, connect to the other DC, and type seize domain naming master. This is drastic — only do it if you're certain the original master is dead.
Check DNS. A common hidden cause is a DNS record pointing to the old domain name. Look at the forward lookup zone for your domain — if there's a stray _ldap._tcp.dc._msdcs record with an old domain suffix, delete it. Then run ipconfig /flushdns and net stop netlogon && net start netlogon.

Prevention tip

The real fix is to never let a domain rename get interrupted. Before you start rendom /execute, do three things: make sure every DC is online and replicating (use repadmin /replsummary and fix any issues), back up the System State of the domain naming master, and close any open MMC snapshots that might hold locks on AD. Also set a maintenance window — domain renames can take hours, and you don't want someone rebooting a DC halfway through. If you must interrupt, use rendom /abort immediately rather than just walking away; that's what prevents the 0X000021A4 mess.