Fix ERROR_DS_SRC_DC_MUST_BE_SP4_OR_GREATER (0X0000216F)

You're in the middle of a domain migration, or maybe you just added a Windows 2003 or 2008 R2 domain controller to an old Active Directory forest. Everything was fine until replication started failing. Check the event logs on the new DC and you'll see this gem: ERROR_DS_SRC_DC_MUST_BE_SP4_OR_GREATER (0X0000216F) with the message "For security reasons, the source DC must be NT4SP4 or greater."

The trigger is almost always a Windows NT 4.0 domain controller — one that hasn't been touched since the Clinton administration — trying to replicate directory changes to a Windows 2000 or later DC. Microsoft locked this down in Security Bulletin MS00-006. After that, any NT4 DC below Service Pack 4 is flat-out rejected by newer AD versions. The protocol upgrade in SP4 fixed a buffer overrun in the SAMRPC call. Without it, the old DC is a security risk.

Root Cause in Plain English

Active Directory replication uses a set of RPC calls between domain controllers. NT4 SP3 and earlier versions of those calls have a known security hole. Windows 2000 and later refuse to talk to them over the replication pipe. So the newer DC literally says "no way, update first." The error code 0X0000216F maps to ERROR_DS_SRC_DC_MUST_BE_SP4_OR_GREATER in the NT status codes.

How to Fix It

You've got three options. Pick the one that matches your environment.

Option 1: Upgrade the NT4 DC to SP4 or Later

1. Download SP4_i386.exe from the Microsoft archive (or use your MSDN media).
2. Run the installer on the NT4 DC. Reboot when prompted.
3. After the reboot, run dcdiag /test:replications from any Windows 2000+ DC to confirm the error clears.

Note: SP4 is the only service pack that fixes this. SP5 and SP6a include SP4 fixes, but if you're going that far, just go straight to SP6a. Also — if the NT4 DC is your PDC emulator, you'll need to seize that role first if you plan to decommission it later.

Option 2: Quarantine the NT4 DC (Quick Fix)

If you can't upgrade right now — maybe the server is running some legacy app that breaks with SP4 — you can stop replication at the firewall level. Block TCP ports 389, 445, and 636 between the NT4 DC and all other domain controllers. Then run this on the newer DC to force sync with only SP4+ sources:

repadmin /options +DISABLE_INBOUND_REPL

That disables inbound replication on the newer DC. It's a band-aid, not a fix. You'll need to eventually upgrade or remove the NT4 box.

Option 3: Decom the NT4 DC

1. Transfer any FSMO roles off the NT4 DC onto a Windows 2000+ server. Use ntdsutil on the newer DC.
2. Demote the NT4 DC using dcpromo (if it's a domain controller). If dcpromo fails, manually remove it from AD using ntdsutil metadata cleanup.
3. Remove the old server object from Active Directory Sites and Services.

What to Check If It Still Fails

If the error persists after upgrading or removing the NT4 DC, check these three things:

• Verify the upgrade took. Run winver on the NT4 box. It should show at least version 4.00.1381.
• Check for other pre-SP4 DCs. Run dcdiag /q on the newer DC. Any DC listed with a status of "failed" might be the culprit. Also grep the output for the string 0x216f in repadmin /showrepl.
• Firewall or RPC port issues. Sometimes the error masks a deeper connectivity problem. Run nltest /dsgetdc: to see which DC is being contacted. If it's still the old NT4 box, you've got DNS or site topology problems.

One more thing — don't bother with registry hacks to bypass this check. There's no AllowNT4Replication key. The security fix is baked into the kernel. You either upgrade the source DC or you block it.