Fix ERROR_DS_KEY_NOT_UNIQUE 0x0000214F in Active Directory

Quick answer

Open ADSI Edit, connect to the partition showing the error, find the object with the duplicate key (use LDP.exe or a PowerShell query to locate it), then delete the duplicate object.

What this error actually means

You're seeing ERROR_DS_KEY_NOT_UNIQUE (0x0000214F) when a domain controller tries to replicate or look up an object. The error text says "The object requested was not found, but an object with that key was found." That sounds confusing, but here's what's happening: Active Directory uses a key (usually the objectGUID or a distinguishedName tag) to identify objects. When two objects in the same partition have the same key — say, the same GUID or the same RDN — the directory can't tell them apart. The system finds the key, but it lands on two objects instead of one, so it gives up and throws this error.

I've seen this most often after a failed restore, a partial replication cycle, or a poorly written script that tried to create an object that already existed. It also pops up if you manually edit attributes in ADSI Edit and accidentally make two objects identical in their naming attributes. The real fix is simple: find and kill the duplicate.

Step-by-step fix

Identify the partition where the error occurs. The error message usually includes the partition name (like CN=Users,DC=contoso,DC=com). Write it down.
Open ADSI Edit. From Server Manager, go to Tools, then ADSI Edit. If you're on a domain controller, it's already there.
Connect to the right partition. Right-click ADSI Edit in the top-left pane, choose Connect to. In the dialog, under Connection Point, choose Select a well-known Naming Context and pick the partition from the error (e.g., Default naming context). Click OK.
Find the duplicate. Expand the partition tree. Navigate to the container mentioned in the error. Look for two objects with identical names or identical objectGUIDs. Use View → Attributes to see the objectGUID column. If you can't spot it visually, use LDP.exe or PowerShell:
```
Get-ADObject -Filter * -SearchBase "CN=Users,DC=contoso,DC=com" -Properties objectGUID | Group-Object objectGUID | Where-Object { $_.Count -gt 1 }
```
Delete the duplicate. Right-click the duplicate object (the one you're sure shouldn't be there — check creation date, last modified, and whether it's referenced by other objects). Choose Delete. Confirm the dialog.
Force replication. On the domain controller that threw the error, open Active Directory Sites and Services, expand your site and server, right-click NTDS Settings, choose Replicate Now. Wait 30 seconds and check if the error clears.

Alternative fixes if that doesn't work

If you can't find the duplicate in ADSI Edit, the issue might be in the database itself. Try these in order:

Run DCDiag and Repadmin. From an elevated command prompt, run dcdiag /test:replications /v and repadmin /showrepl. These will tell you which DC has the problem and which object is stuck.
Use NTDSUTIL to remove the duplicate. In the same command prompt, type ntdsutil, then metadata cleanup. Follow the prompts to identify and remove the orphaned object. This is for advanced users — one wrong move and you can kill replication for the whole domain.
Restore from a known-good backup. If the duplicate corrupts a critical object (like a domain controller or an admin account), you can't just delete it. Run an authoritative restore of Active Directory from a backup taken before the duplicate appeared. This is the nuclear option — only do it if you're sure the backup is clean.

Prevention tip

Stop creating objects with scripts that don't check for duplicates first. Always query for an existing object before you try to create a new one. Enable strict replication consistency checks in your domain — set strict replication consistency to 1 using repadmin /regkey. This forces DCs to flag duplicate keys immediately instead of letting them pile up.

One more thing: if you're running Windows Server 2008 R2 or older, upgrade. Those versions have a known bug where a tombstone reanimation can create duplicate keys. That bug was fixed in Server 2012 and later.