Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Windows 2008 server which failed to boot due to a corrupted NTDS database. I managed to recover AD in AD Restore Mode, using ESENTUTL to repair the corruption. The system now boots, but my DNS zones were active directory integrated, and one of them has been corrupted.
I figured I would just re-create them, but when i try to remove the corrupted zone i get an error..

"Zone Cannot be Deleted. Active Directory Service unavailble"

I can access AD fine via AD users & computers and also ADSI Edit but cannot find a way of manualy or forcefuly removing the corrupted DNS zone.

when i try to use ADSIEdit to remove the entry from DC=DomainDNSZones i get the error....

Operation Failed. Error code: 0x20ef
The directory service encountered an unknown failure.

000020ef: SvcErr: DSID-020503E2, problem 5005
(UNABLE_TO_PROCEED), data 8203

Any help appreciated.

share|improve this question

Zow. You've got a mess there!

You might try deleting the DNS zone using ADSIEDIT. If it was a forest-wide zone, you're going to find the zone in the ForestDNSZones NC, under the MicrosoftDNS container.

If it was a domain-wide zone, you'll find the zone in DomainDNSZones NC under the same container.

(You really should be backing-up AD and should have probably restored from backup when this happened, but that's another rant for another question.)

share|improve this answer
I'm aware that this would have been a very different job (much easier) having a system state backup, however I'm not the Sys Admin for the this server, just the guy called in to try and resolve the mess. As for ADSI edit please see the amended post above. – Jon Crosse Jun 2 '09 at 13:43
Sorry for sounding snobby-- I've definitely been "that guy" who has to clean up such a mess. I'm curious how LDP.EXE does for you deleting the DNS zone container. – Evan Anderson Jun 2 '09 at 13:54

Problem Resolved!

Had to reset permissions on the DC=domainName object in ADSIEdit.

Thanks to evan for his quick response though.

share|improve this answer
Good to hear it's resolved. Slap that sysadmin around a little bit and get him / her to start taking regular backups! – Evan Anderson Jun 2 '09 at 13:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.