Fix Windows ERROR_DS_NAME_REFERENCE_INVALID (0x20B5) in 3 Steps

What This Error Means (and Why It Happens)

When you see ERROR_DS_NAME_REFERENCE_INVALID (0x20B5), it means Active Directory can't find a proper name reference for a domain controller. This usually shows up during a domain join, when creating a trust, or when you're trying to move a computer between OUs. The directory service is literally saying, "I don't know who you're referencing."

I've seen this most often on Windows Server 2016/2019/2022 when a DC was demoted but its metadata lingers, or when DNS points to a dead server. It's infuriating because the error text is vague, but the fix is usually straightforward. You don't need to rebuild anything.

Here's the troubleshooting flow. Start with step 1, test, then move down if needed. Most people stop at step 2.

Step 1: Flush DNS and Re-register (30 seconds)

DNS is the foundation of AD name resolution. If your client can't resolve the domain name to a live DC, you'll get this exact error. This fix is free and takes seconds.

Open Command Prompt as Administrator and run:

ipconfig /flushdns
ipconfig /registerdns
nltest /dsgetdc:yourdomain.com

Replace yourdomain.com with your actual domain. The nltest command will show which DC it's using. If it returns a DC that's offline or a stale entry, you've found the problem.

If nltest fails or returns an old server, edit your network adapter's DNS settings to point to a known good DC's IP. Don't rely on your router's DNS for AD—that's a common mistake. Also check the DNS server's forwarders and make sure the domain zone is active.

Test: Try the domain join again. If it works, you're done. If not, move to step 2.

Step 2: Verify Permissions and Object References (5 minutes)

If DNS is fine, the error might be permission-related. When you join a computer to the domain, you need the "Create computer objects" permission in the target OU. But 0x20B5 can also pop up if the computer object already exists but is stale—the domain name reference points to a deleted or moved object.

First, check what account you're using. Standard users can join computers, but only a limited number. If you're using a domain admin account and it still fails, look at the existing computer object.

On a DC, open Active Directory Users and Computers (ADUC). Find the computer object with the same name as the machine you're joining. If it exists:

• Right-click and reset it (if it's a computer account).
• Or delete it entirely, then retry the join.

Also, look for any trust relationships that might be broken. If you're setting up a trust with another domain, make sure the other side's DNS is reachable and that the trust's name suffix matches. A mismatch in the DNS name or NetBIOS name can cause this error.

Test: Retry. Still stuck? Go to step 3.

Step 3: Remove Stale Domain Controller Metadata (15+ minutes)

This is the advanced fix, and the one that solves the stubborn cases. If a DC was demoted but its metadata wasn't cleaned, other DCs still reference it. That broken name reference triggers 0x20B5 even though the error seems unrelated to your actual operation.

On a working DC, open Command Prompt as Administrator and run:

repadmin /replsummary
repadmin /showvector

Look for any DCs that show as“not responding” or have outdated vectors. Note the DNS name of the dead DC.

Then use ntdsutil to remove the stale metadata:

ntdsutil
metadata cleanup
select operation target
list sites
select site 0
list servers in site
select server 0
list domains
select domain 0
remove selected server

Follow the prompts and quit when done. You'll need to know which server is stale—if you're not sure, pick the one that's failing replication.

Also check the DNS zone for any leftover A or CNAME records pointing to that dead DC. Delete them. Go to DNS Manager, expand your domain zone, and remove entries for the old server.

Finally, run repadmin /syncall /AdeP to force replication across remaining DCs.

Test: Now try the domain join or trust setup again. In most cases, this clears it.

What if none of this works?

If you're still hitting 0x20B5 after all three steps, your AD database might be more deeply corrupted. Check the event logs (Event Viewer > Windows Logs > Directory Service) for related errors. A metabase update or system state restore could be next, but that's rare. In my years of troubleshooting this, step 3 resolved almost every stubborn case.

One more thing: if you're on a client machine (Windows 10/11) trying to join a domain and you see this, also check the Local Security Policy for "This computer may be trusted to delegate" settings—but that's an obscure edge case. Start with the steps above.

Good luck. That error's a pain, but it's beatable.