"Active Directory could not delete the crossRef object" error message when you try to demote a Windows Server 2003-based domain controller (883274)



The information in this article applies to:

  • Microsoft Windows Server 2003, Standard Edition
  • Microsoft Windows Server 2003, Enterprise Edition
  • Microsoft Windows Server 2003, Web Edition

SYMPTOMS

When you use the Dcpromo.exe utility to demote a Microsoft Windows Server 2003-based domain controller, you may receive an error message that is similar to the following:
Active Directory could not delete the crossRef object

CAUSE

This problem may occur if the following conditions are true:
  • The Windows Server 2003-based domain controller is a member of the replica sets for the DomainDnsZones and ForestDnsZones application partitions.
  • The Windows Server 2003-based domain controller is the last Windows Server 2003-based domain controller in the domain.
  • There are Microsoft Windows 2000-based domain controllers in the domain.

WORKAROUND

To work around this issue, use one of the following methods.

Method 1: Remove the DNS service

  1. Click Start, click Run, type Appwiz.cpl, and then click OK.
  2. Click Add/Remove Windows Components, double-click Networking Services, click to clear the Domain Name System (DNS) check box, and then click OK.
  3. Click Next, and then follow the instructions to complete the removal process.

Method 2: Remove the domain controller from the naming context replica set

Use the Ntdsutil.exe command-line utility to remove the domain controller from the DomainDnsZones and ForestDnsZones naming contexts. To do this, follow these steps:
  1. Click Start, click Run, type ntdsutil, and then click OK.
  2. Type domain management, and then press ENTER.
  3. Type connections.
  4. Type connect to server server_name to connect to the server to which you want to apply the changes. Type the actual name of the server instead of server_name.
  5. Type quit to return to domain management.
  6. Type remove nc replica naming_context server_name, where naming_context is the naming context from which you want to remove the server, and where server_name is the name of the domain controller. Then, press ENTER.
  7. At the domain management command prompt, type q, and then press ENTER.
  8. At the ntdsutil command prompt, type q, and then press ENTER.

STATUS

Microsoft has confirmed that this is a bug in the Microsoft products that are listed in the "Applies to" section.

Modification Type:MajorLast Reviewed:11/16/2005
Keywords:kbdomain kbwinservnetwork kbtshoot kbprb KB883274 kbAudITPRO