Fix ERROR_DS_ENCODING_ERROR (0X0000203C) on Windows Server
This error hits when Active Directory replication fails due to a corrupt or unreadable attribute. The fix is usually a metadata cleanup or a low-level DIT repair.
When This Error Shows Up
You'll see ERROR_DS_ENCODING_ERROR (0X0000203C) in the Directory Service event log or as a pop-up when you try to replicate between domain controllers. It usually happens right after a failed schema update or an incomplete attribute modification. I've seen it most often on Server 2012 R2 and 2016 boxes that had a sync interrupted by a power loss or network drop.
The exact error text reads: "An encoding error has occurred." It means the destination DC can't decode a replicated attribute — something's busted in the binary data or the LDAP syntax is wrong.
Root Cause
Active Directory stores attributes in a database (NTDS.DIT) that uses specific encoding rules. When a piece of data — like a userCertificate or thumbnailPhoto — gets corrupted during write or replication, the directory service throws this error. The culprit here is almost always a malformed attribute value that doesn't match its schema syntax. For example, a JPEG photo attribute that got truncated or a certificate blob that's missing bytes.
Don't bother with full domain recovery or rebuilding DCs — that's overkill unless you've got hardware failure. The real fix is either removing the bad object or repairing the database.
How to Fix It
Step 1: Identify the Bad Object
Check the Directory Service event log for Event ID 1699 or 1988. It'll give you the object GUID and attribute name. Run this on the source DC that's failing to replicate:
repadmin /showobjmeta * "Replace with the distinguished name from the event. Look for any attributes with weird timestamps or zero-length values.
Step 2: Remove the Corrupt Object
If it's a user or group, delete it from AD Users and Computers. For system objects or schema attributes, use ntdsutil metadata cleanup:
ntdsutil
metadata cleanup
connections
connect to server
quit
select operation target
list domains
select domain
list sites
select site
list servers in site
select server
quit
remove selected server This removes the broken DC reference. If the bad object is a specific user or computer, use ADSI Edit instead: navigate to the object, right-click, and delete. Don't force-delete critical system objects without a backup.
Step 3: Repair the Database (If Object Deletion Fails)
If you can't delete the object — say it's a schema attribute — run ntdsutil semantic database analysis:
ntdsutil
semantic database analysis
verbose on
go
cleanThis scans the DIT for encoding errors and tries to fix them. It's not a guarantee, but I've seen it work on about 60% of cases. If it still fails, you'll need to go offline:
- Reboot the DC into Directory Services Repair Mode (DSRM).
- Run
ntdsutiland choosefilesthenrepair. - Let it rebuild the database. This can take hours on large domains (10k+ objects).
- Reboot normally and force replication with
repadmin /syncall.
What to Check If It Still Fails
- Schema version mismatch: Make sure all DCs are on the same schema version using
adprep /forestprep /domainprep. Runrepadmin /schemato compare. - Third-party LDAP filters: If you've got antivirus or backup software intercepting LDAP traffic, disable it temporarily. I've seen McAfee and Symantec products corrupt attribute encoding.
- Hardware issues: Run CHKDSK on the drive hosting NTDS.DIT. Bad sectors can cause encoding corruption. Replace the disk if you see reallocated sectors.
- Check for lingering objects: Use
repadmin /removelingeringobjectson the failing DC. These are tombstoned objects that didn't get cleaned up.
If none of this works, your best bet is to demote the problematic DC and promote a fresh one. That's rare, but it happens. Keep a clean backup of the DIT for next time.
Was this solution helpful?