Fix ERROR_DS_OBJ_NOT_FOUND (0x0000208D) in Active Directory

Active Directory can't find an object you're looking for. Usually a replication mismatch or a stale reference. Here's how to track it down and kill it.

Quick Answer

Run repadmin /showrepl to find the stale domain controller, then use ntdsutil metadata cleanup to remove its orphaned object.

Why You're Seeing This

This error pops up when Active Directory can't locate an object that a process or another DC expects to exist. The culprit here is almost always a domain controller that was decommissioned or failed without proper metadata cleanup. You'll also see it after a forced removal of AD DS (dism /online /remove-feature) or when a DC's NTDS Settings object gets corrupted during replication. Common trigger: you promote a new DC, and 0x0000208D shows up in Event ID 1126 or during netdom query fsmo. The error means the directory service hit a reference to an object — maybe a server reference in a site link, a cross-ref, or a child object — and that object doesn't exist anymore.

Fix Steps

Identify the orphaned DC or object
Open PowerShell as admin and run:
```
repadmin /showrepl * /csv | Out-GridView
```
Look for rows with “last success” blank or “last failure” showing 0x208D. Note the source DC name.
Check the AD database for the missing object
On a working DC, open ADSI Edit (add it from RSAT if missing). Connect to CN=Configuration,DC=yourdomain,DC=com. Navigate to CN=Sites,CN=Default-First-Site-Name,CN=Servers. Find the server name from step 1. If it's missing, that's your problem.

Clean up metadata with ntdsutil
On any surviving DC, run:

ntdsutil
metadata cleanup
connections
connect to server YourGoodDC.yourdomain.com
quit
select operation target
list domains
select domain 0
list sites
select site 0
list servers in site
select server X (where X is the number of the orphaned DC)
quit
remove selected server
yes

Exit out.

Force replication and verify
Run:
```
repadmin /syncall /AdeP
```
Then check with:
```
repadmin /showrepl
```
The 0x208D error should be gone.
If the error persists, check for lingering objects
Use repadmin /removelingeringobjects ServerName DC=yourdomain,DC=com /advisory_mode first to see what it finds, then run without /advisory_mode to clean them.

Alternative Fixes If the Main One Fails

If metadata cleanup doesn't help, the object might be in a different partition. Try:

Schema partition cleanup: In ADSI Edit, connect to CN=Schema,CN=Configuration,DC=yourdomain,DC=com. Look under CN=Schema for orphaned class or attribute objects. Delete only if you're 100% sure they're unused. Schema changes are irreversible.
Force authoritative restore: Only as a last resort. Reboot the DC into Directory Services Restore Mode. Use ntdsutil → authoritative restore → restore object CN=ProblemObject,DC=domain,DC=com. Then normal reboot and replication.
Delete and re-create the server object: Using ADSI Edit, right-click the missing server's NTDS Settings object under CN=Servers, select Delete, then re-create manually with the same GUID if possible. This is hacky but works in a pinch.

Prevention Tip

Never decommission a DC without running DCPromo /forceremoval (for old Server 2008) or the proper AD DS removal wizard. Then always run metadata cleanup immediately after. Set up a monthly repadmin /showrepl report to catch stale objects before they break stuff. Also, enable strict replication consistency with repadmin /options +DISABLE_INBOUND_REPL (no, that's for strict mode — actually set repadmin /regkey +DISABLE_INBOUND_REPL on all DCs, wait — that's not right either. Just enable strict replication consistency via: repadmin /regkey DC1 +DISABLE_INBOUND_REPL? Damn. Forget the registry tweak. The real prevention: run repadmin /showrepl weekly and clean up any DC that's been dead for 30 days. That's it.