Error 8340: metadata cleanup after a domain controller that never came back

Fix it now

Error 8340 is ERROR_DS_CANT_DELETE_DSA_OBJ: the DSA object cannot be deleted. That object is the directory’s record of a domain controller, and it has a defined removal procedure the console route invokes and a raw delete does not. If the server is genuinely gone, metadata cleanup is what removes it.

netdom query fsmo
repadmin /replsummary

1. Confirm the server will never come back. Metadata cleanup is not reversible, and a server that returns afterwards will try to replicate as a controller the directory no longer knows about.
2. Seize any operations master role the dead server holds onto a live controller before you remove anything. You need Enterprise Admins for the schema master or the domain naming master, and Domain Admins for the PDC emulator, RID master and infrastructure master.
3. In Active Directory Users and Computers, with Advanced Features on, open the Domain Controllers organisational unit, delete the computer object, and tick “This Domain Controller is permanently offline and can no longer be demoted using the Active Directory Domain Services Installation Wizard (DCPROMO)”. You need Domain Admins to do this.
4. In Active Directory Sites and Services, remove any surviving NTDS Settings object and then the server object, then clear the dead server’s records out of DNS.

If the server is only switched off rather than dead, do not do any of this. Power it on and run Uninstall-ADDSDomainController on the machine itself, which removes everything cleanly and tells its partners about it.

If the server has gone from both consoles and replication no longer names it, you are done. If the delete is still refused, the next section covers the ntdsutil route and what else has to come out.

Why it happens

A domain controller is not one object. Its computer account sits in the Domain Controllers organisational unit; its NTDS Settings object sits beneath a server object in the configuration partition, inside the site it belonged to; its name appears in the replication connection objects of its partners; and in DNS it owns a host record, an alias under the _msdcs zone and service records advertising it. Delete one part and the others carry on describing a server that is not there.

8340 is the directory protecting that structure. ERROR_DS_CANT_DELETE_DSA_OBJ says the DSA object – the directory service agent object, which is the controller’s own identity in the configuration partition – cannot be deleted. Deleting the computer account through Active Directory Users and Computers invokes the proper removal with the right flags set, which is why the console route succeeds where a raw delete in a low-level editor does not.

8419 is the other side of the same coin and normally appears afterwards, on the partners rather than on the server you are working from. ERROR_DS_CANT_FIND_DSA_OBJ means the DSA object could not be found: a partner still holding a connection to the removed controller reports it until the removal replicates round. Left alone it usually clears within a cycle or two.

Two more codes in the same range get attached to this work and neither belongs to it. 8546 is ERROR_DS_NC_STILL_HAS_DSAS – a domain could not be deleted because domain controllers still host it, which is about removing a whole domain rather than a single server. 8547 is ERROR_DS_GC_REQUIRED – the operation can only be performed on a global catalog server, which means you are bound to the wrong server, not that an object is missing.

ntdsutil
metadata cleanup
connections
connect to server DC01
quit
remove selected server DC02
quit
quit

Full reference

The codes you will see during this work

Read 8546 carefully if you meet it here, because it is about a domain rather than a server. It appears when somebody tries to remove a whole naming context while controllers still host it, which is a different operation from tidying up after one dead machine and needs those controllers dealt with first.

The documented ntdsutil sequence

ntdsutil
metadata cleanup
connections
connect to server DC01
quit
remove selected server DC02
quit
quit

DC01 is a healthy replication partner you are connecting through; DC02 is the server being removed, given as its fully qualified or NetBIOS name. Older guidance walks a select operation target menu – list domains, select domain, list sites, select site, list servers – before removing the selected server. The shorter form above is what Microsoft documents now, and it removes the opportunity to select the wrong server by index number.

Where the leftovers hide

Metadata cleanup permanently removes a controller from the directory and must never be run against a server that is merely unreachable. If that server later comes back online it still holds a database copy, will try to replicate as a controller the directory no longer knows, and can reintroduce objects deleted while it was away. Take a system state backup of a healthy controller first, and physically confirm the dead server is dead.

Order matters

1. Seize any operations master roles onto a live controller.
2. Delete the computer object through Active Directory Users and Computers with the permanently-offline confirmation. On current builds this performs the cleanup for you.
3. Remove the NTDS Settings object before the server object in Sites and Services – the parent cannot go while the child is there.
4. Clear the DNS records, including the _msdcs alias.
5. Force replication and re-check from a second controller in a different site.
6. Only then decide whether you need to replace the server you have just removed.

If the delete is refused and ntdsutil will not help either

• Confirm you are a member of Domain Admins, which is what the console route requires.
• Confirm you are bound to a live, healthy controller and not to a stale replica of the configuration partition.
• Check whether the object you are trying to delete has children. The NTDS Settings object has to go before the server object.
• Check whether replication is broken between the controller you are using and the rest of the domain, because a change written here may simply not be going anywhere.
• Check for an 8547, which means the operation needs a global catalog and you are not on one.

Every code this article covers

Confirm the fix worked

1. Get-ADDomainController -Filter * run from two controllers does not list the removed server on either.
2. repadmin /replsummary reports no failures naming it.
3. The _msdcs zone and the forward lookup zone hold no records for the old server.
4. netdom query fsmo returns a live, answering server for every role, and two controllers agree on the answers.
5. Clients in the removed server’s site are authenticating against a controller that still exists, rather than timing out first.

Questions people ask about this