Quick Answer
Force seize the FSMO role using ntdsutil commands. The old DC is gone and won't come back.
What's Happening
You're trying to transfer a FSMO role—maybe the PDC emulator or schema master—and you get the 0X000021A2 error. This isn't a random failure. It happens when the domain controller that currently holds the role is unreachable. It could be crashed, turned off, or its network is dead. The error means the target DC didn't respond during the transfer attempt.
Common scenario: you're in the middle of decommissioning an old DC (Server 2008 or 2012), and you try to move roles to a new 2019 or 2022 server. The old DC is offline, maybe corrupted, and won't boot. The transfer fails with this code.
The Windows interface won't help you here. You have to force the role off the dead DC using command-line tools. Don't panic—it's safe if you do it right.
Fix Steps
Step 1: Open ntdsutil as Admin
On the surviving domain controller (the one you want to hold the role), open Command Prompt as Administrator. Do this:
- Press Win + R, type
cmd, hold Ctrl + Shift, press Enter. Click Yes on the UAC prompt. - Type
ntdsutiland press Enter. You'll see a prompt that saysntdsutil:.
After that, your screen should look like:
C:\Users\Admin>ntdsutil
ntdsutil:Step 2: Enter Role Management
At the ntdsutil: prompt, type:
rolesPress Enter. The prompt changes to fsmo maintenance:.
Step 3: Connect to the Surviving DC
Now type:
connectionsPress Enter. You'll see server connections:. Then type:
connect to server YOUR_SERVER_NAMEReplace YOUR_SERVER_NAME with the actual name of the DC you're on (or the one you want to host the role). Hit Enter.
You should see a confirmation message like Binding to YOUR_SERVER_NAME... Connected to YOUR_SERVER_NAME using credentials of locally logged on user.
Step 4: Seize the Role
Type quit to go back to fsmo maintenance:. Now you'll seize the specific role that failed. Common roles and their commands:
- Schema Master:
seize schema master - Domain Naming Master:
seize naming master - PDC Emulator:
seize pdc - RID Master:
seize rid master - Infrastructure Master:
seize infrastructure master
Type the one you need and press Enter. You'll get a warning popup: Are you sure you want to seize the role?. Click Yes.
After that, you'll see something like Transfer of FSMO role succeeded. It worked.
Step 5: Exit ntdsutil
Type quit twice to exit back to the command prompt. Close the window.
Alternative Fixes If the Main One Fails
Sometimes the seize command itself fails with the same error. If that happens, the problem is the surviving DC can't even connect to itself. Check these:
1. Firewall Blocking RPC
The seize command uses RPC (port 135 and dynamic ports). Make sure Windows Firewall on the surviving DC allows Active Directory Domain Controller rules. Quick test: disable the firewall temporarily on that DC (only for testing). If it works, you know it's firewall.
2. DNS Resolution Problem
Your DC must resolve its own name to its IP. Run this check:
ping YOUR_SERVER_NAME
nslookup YOUR_SERVER_NAMEIf the IP is wrong or it fails, fix DNS. Go to the DC's network adapter settings and set its preferred DNS to itself (127.0.0.1) or another DC. Then run ipconfig /flushdns and try again.
3. AD Is Broken
If the surviving DC itself has corruption, the seize won't work. Run dcdiag /c and look for failures. If you see many errors, you might need to restore AD from backup or rebuild the DC.
Prevention Tip
Don't let a DC go offline without first transferring its FSMO roles. Before you shut down an old DC, open Active Directory Users and Computers, right-click the domain, and choose Operations Masters. Move each role while the old DC is still running. That avoids the whole seize mess. If the old DC is dead, at least have a backup of the system state from before it crashed—it'll save you hours.