Fix ERROR_PROMOTION_ACTIVE (0x0000201D) – Domain Controller Promotion Stuck

The 30-Second Fix: Just Reboot

What's actually happening here is that the previous DCPromo operation—or an unattended promotion script—left a stale lock file in the system registry. When you see ERROR_PROMOTION_ACTIVE (0x0000201D), Windows thinks a promotion is still running, even if the process crashed or you canceled it.

The simplest thing: restart the server. Yes, it's that dumb. A clean reboot clears the temporary promotion state from memory and releases the lock. If the promotion was actually still running (e.g., a hung process), this kills it.

After reboot, try running dcpromo or Install-ADDSForest again. If it works, you're done. If not, move on.

The 5-Minute Fix: Delete the Promotion Flag from Registry

If reboot didn't help, the lock is stored persistently in the registry. You need to delete a specific key. This is the real fix for 90% of cases.

1. Open Regedit as Administrator.
2. Navigate to:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters

3. Look for a value named DSA Database Restore In Progress. If it exists and is set to 1, delete it (or set it to 0). This flag tells Windows a promotion or restore is still happening.
4. Also check for Promotion In Progress or similar DWORD values. If you see any value that isn't standard (compare with a working DC), delete it.
5. Close Regedit and restart the server. Yes, reboot again—the NTDS service reads this at startup.

The reason this works: The NTDS service checks those registry values during initialization. If the stale flag remains, it refuses to start properly and blocks new promotions. Deleting it resets the state.

The 15+ Minute Advanced Fix: ADSI Edit and Metadata Cleanup

If the registry fix didn't do it, the problem runs deeper. A partially promoted DC may have created objects in Active Directory that are now orphaned. The promotion lock is being enforced by actual directory entries, not just a local registry flag.

You'll need to connect to another working domain controller (if one exists) or, if this is the only DC, you're looking at a forest recovery scenario.

Step 1: Remove the Stale NTDS Settings Object

1. Open ADSI Edit (install via Server Manager if missing).
2. Connect to the Default naming context of your domain.
3. Navigate to CN=Servers,CN=<SiteName>,CN=Sites,CN=Configuration,DC=<Domain>,DC=<TopLevel>
4. Find the server object for the problematic machine. Under it, delete the NTDS Settings child object.
5. This removes the directory-side lock that tells other DCs this server is mid-promotion.

Step 2: Check the Domain Partition

1. In ADSI Edit, connect to the Domain partition (e.g., DC=contoso,DC=com).
2. Look for a computer object with the same name as the stuck server. If it exists and doesn't have a userAccountControl value that includes WORKSTATION_TRUST_ACCOUNT (0x1000), you may need to delete and rejoin.
3. If the server was partially promoted, the computer account might have the SERVER_TRUST_ACCOUNT flag (0x2000) set incorrectly. Delete the object and let the next promotion create a clean one.

Step 3: Force Remove with ntdsutil

If ADSI Edit is too GUI-heavy, use the command line:

ntdsutil
metadata cleanup
remove selected server <ServerName> on <OtherDC>
quit
quit

This is the nuclear option. Only do this if you're certain the stuck server isn't a functional DC. Running it against a live server will break replication.

When to Give Up and Demote by Force

Sometimes the server is so hosed that none of the above helps. At that point:

1. Make sure you have a backup of the system state (if the server was ever a working DC).
2. Run dcpromo /forceremoval from an elevated command prompt. This tears down AD without talking to other DCs.
3. After reboot, clean up metadata manually using ntdsutil (as above) from another DC.

I've seen this error most often when someone clicks Cancel during a slow promotion over a VPN. The lock persists even after the GUI disappears. Don't let a timeout fool you—always check the registry first.