Fix ERROR_DS_TREE_DELETE_NOT_FINISHED (0X000020CD) in Active Directory

What's happening here?

This error trips up anyone who's tried to demote a domain controller and got stuck halfway. You see ERROR_DS_TREE_DELETE_NOT_FINISHED (0X000020CD) in the DCPROMO logs or when running Remove-ADDomainController. It means the Active Directory database has a partially deleted tree — a directory partition subtree that didn't finish deleting. This usually happens when a previous demotion failed or a replication partner went offline mid-operation.

I've seen this most often on Windows Server 2019 and 2022 boxes that were domain controllers in a child domain, or after an attempted ungraceful demotion. The real trigger? The AD replication engine got interrupted while trying to clean up the NTDS settings object. Don't panic — it's fixable without rebuilding the server.

Step 1: The 30-second fix — check if it's already done

Sometimes the deletion actually finished, but the error code lingers. Run this from an elevated command prompt or PowerShell on the problematic DC:

repadmin /showrepl

Look for any Last failure entries showing 0x20CD. If you don't see any, the deletion might have completed but the NTDS object wasn't cleaned up. In that case, skip to Step 3.

If you do see the error, move to Step 2.

Step 2: The 5-minute fix — force replication and retry the deletion

This is the fix that works 70% of the time. Open an elevated PowerShell on the DC showing the error:

repadmin /syncall /AdeP

This forces a full replication sync with all partners. After that completes (might take a minute or two), run:

repadmin /removelingeringobjects <DC-name> <partition-DN> /advisory_mode

Replace <DC-name> with your DC's FQDN and <partition-DN> with the DC's partition (e.g., DC=Domain,DC=com). Run it in advisory mode first to see what it would remove. If it lists the stuck tree deletion object, rerun without /advisory_mode.

Now try the demotion again via Server Manager or Remove-ADDomainController. If it still fails, go to Step 3.

Step 3: The 15+ minute fix — manually remove the stuck NTDS settings object

This is the nuclear option, but it's safe if you're careful. We're going to directly delete the NTDS Settings object that's stuck in a half-deleted state.

First, identify the offending object. Run this on any other DC in the domain:

dsquery * CN=NTDS Settings,CN=<ServerName>,CN=Servers,CN=<SiteName>,CN=Sites,CN=Configuration,DC=Domain,DC=com -scope base -attr objectGUID objectClass

Replace the path with your actual server and site name. If you get an error saying the object doesn't exist, it's already gone — skip to the cleanup below. If it exists, proceed.

Use ADSI Edit (install via RSAT if needed) to connect to the Configuration partition. Navigate to:

CN=Configuration,DC=Domain,DC=com → CN=Sites → CN=<YourSite> → CN=Servers → CN=<ServerName> → CN=NTDS Settings

Right-click the NTDS Settings object and delete it. Confirm the deletion. Yes, it's that direct.

Now, on the problem DC itself, clean up any leftover metadata:

ntdsutil
metadata cleanup
connections
connect to server <another-DC>
quit
select operation target
list domains
select domain 0
list sites
select site 0
list servers in site
select server 0
quit
remove selected server
quit
quit

Reboot the problem DC. Then try demoting again. It should work now.

What if none of this works?

If you're still stuck, the DC's AD database is corrupted beyond simple repair. Your last options are:

• Force removal using Remove-ADDomainController -Force on another DC, then clean up metadata manually.
• Reinstall the server from scratch. Not ideal, but sometimes faster than chasing ghost objects.

I've been in your shoes — this error made me cancel a weekend plan once. But these steps will get you through it.