Fix ERROR_DS_DRA_BAD_NC (0X000020F8) – Invalid Naming Context

Quick answer for advanced users

Run repadmin /syncall /AdeP to force replication, then if that fails, remove the stale naming context reference via ADSI Edit from the destination DC's CN=Partitions container under CN=Configuration.

What's actually happening here

You're seeing ERROR_DS_DRA_BAD_NC (0X000020F8) — literally "The naming context specified for this replication operation is invalid." This means a domain controller is trying to replicate a partition (like a domain or application partition) that the destination DC doesn't recognize as valid. This usually happens after you demote a DC improperly, or when an application partition gets orphaned — you delete the partition object from one DC but another DC still has a reference to it. I've seen this most often with Windows Server 2019 and 2022 after botched domain controller demotions or failed schema updates.

The reason the error is stubborn: replication is a multi-master system, but naming contexts are tracked in the Configuration partition. If a DC has a lingering reference to an NC that's been deleted elsewhere, it won't replicate until that reference is manually removed. The error comes from the destination DC rejecting the incoming replication because it can't find the NC in its local copy of the Configuration partition.

Fix steps — numbered, in order

1. Identify the offending naming context. On the source DC (the one pushing replication), run:
   repadmin /showrepl
   Look for the partition that shows a failure with error 0x20f8. Note the partition's DN (distinguished name) — it looks like DC=domain,DC=com or CN=Something,CN=Partitions,CN=Configuration,DC=domain,DC=com for application partitions.
2. Force replication with /ADDO. On the destination DC (the one that can't receive), run:
   repadmin /syncall /AdeP
   The /AdeP flags force cross-site, cross-partition replication. If the error persists, move to step 3.
3. Check the destination DC's partition list. On the destination DC, open ADSI Edit. Connect to the Configuration partition (CN=Configuration,DC=domain,DC=com). Navigate to:
   CN=Partitions,CN=Configuration,DC=domain,DC=com
   Look for the partition DN you found in step 1. If it's missing, you've found the problem — the destination DC has no record of that NC.
4. Remove the stale reference from the source DC. This is the real fix if the NC was deleted elsewhere. On the source DC, open ADSI Edit, connect to the Configuration partition, go to the same CN=Partitions container. Find the partition object, right-click, and choose Delete. Confirm the deletion. Do not delete domain partitions — only application partitions or stale DNS zones. If you're deleting a domain partition, you're breaking the domain; don't do it.
5. Force a full replication cycle. After deletion, on the source DC run:
   repadmin /syncall /AdeP
   Then on the destination DC run the same command. The error should clear. Check with:
   repadmin /showrepl
   Look for the partition — it should either be gone or showing success.

Alternative fixes if the main one fails

If removing the partition object from the source doesn't work, try the blunt instrument: demote and re-promote the destination DC. Run dcpromo /forceremoval (on Server 2016+, use Server Manager to remove AD DS roles). This nukes the local AD database and rebuilds it from a healthy DC. It's overkill, but it works when ADSI Edit won't cooperate — especially if the partition is cross-domain and the destination DC has corrupt metadata.

Another option: use ntdsutil to clean up metadata. On a healthy DC, run:
ntdsutil
Then at the ntdsutil: prompt:
metadata cleanup
Select the destination DC that's failing, then remove any lingering naming contexts listed. This is manual but safe if you follow the prompts.

Prevention tip

Never demote a domain controller without first ensuring it's fully replicated. Use repadmin /replsummary on every DC before demotion — if any DC shows errors, fix those first. Also, if you delete an application partition (like a DNS zone or custom partition), make sure all DCs have replicated the deletion before you force anything. A five-minute wait with repadmin /syncall prevents hours of clean up.