Host is Server 2012 with single Hyper-V guest which is a Domain Controller. When booting the DC it gives a Blue Stop Error: 0xc00002e2 and then reboots. After third reboot it shows a recovery console with options for



*Turn off your PC

I choose troublehsoot and open a command prompt and when I tried to run

SFC /scannow

But receive the error: Windows Resource Protection could not start the repair service.

I tried to run chkdsk /r

And receive the error: Windows cannot run disk checking on this volume because it is write protected.

I can boot into DSRM but I'm not sure how to proceed. I try to demote the DC, but receive this error when supplying credentials:

Error verifying credentials: verification of user credential permissions failed. Failed to examine         the Active Directory forest. The error was: The operation cannot continue because LDAP connect/bind operation failed: error 58. Ther specificied server cannot perform the requested operation.)
  • Did you do anything silly, like configure the VM with nonexistent disks? Dec 7, 2013 at 1:17
  • Did it used to start normally in this setup and just broke, or is this a migration scenario?
    – Ryan Ries
    Dec 7, 2013 at 1:49
  • It used to start normally and then it just broke. It was a secondary DC and one day i logged into the main DC and noticed a red flag about the second DC and that has lead me to here.
    – Sandy
    Dec 7, 2013 at 4:28

3 Answers 3


I'm going to go out on a limb and assume that this is not your only domain controller.

Delete the DC's computer object from Active Directory Users and Computers using a version of RSAT for Vista/2008 or later. Then, go into the AD Sites & Services snap-in and delete any reference to it in there. Then, reinstall the OS and promote the server again.

If directory services won't start, you can't do a clean demotion, so this is the best way to clean up a DC that's being taken out of service without a proper demotion. This is also why you can't demote in DSRM.

If this is your only DC, then do what Ryan says and pray for a miracle.

  • This is not my only DC. I also did NOT have a backup of it. Deleted it from ADUC and ADSaS. Rebuilding now. Will include a backup going forward.
    – Sandy
    Dec 13, 2013 at 20:19

The error code is "Directory Services cannot start."

This article has all the ntdsutil tricks you need to check your AD database.

Disregard that the article talks about Small Business Server - the principles are the same.

But here's the thing. You really should read the whole article, because therein are a lot of useful bits of information, such as:

Note Microsoft does not support domain controllers after Ntdsutil or Esentutl is used to recover from Active Directory database corruption. If you perform this kind of repair, you must rebuild the domain controller for Active Directory to be in a supported configuration. The repair command in Ntdsutil uses the Esentutl utility to perform a lossy repair of the database. This kind of repair fixes corruption by deleting data from the database. Only use this kind of repair as a last resort.

So what you should be focusing on is restoring the domain controller from a system state backup. You have a backup, right? Well, if you don't, then you should just blow away the VM and build a new domain. I'll assume you didn't have anything important on that domain controller anyway if you didn't have a backup. :)


My situation involved a physical server which was also an only server, so demotion/promotion would have been painful since all AD accounts would be lost in the process.

Fortunately, I found a better/simpler solution that usually works, or at least did for me.

  • Boot into Directory Services Repair Mode (Troubleshoot / Startup Settings / Restart / Directory Services Repair Mode). It may do some repairs and reboot, requiring you to do this a second time.
  • Login with a local admin account, since AD is not available.
  • Delete (or rename) C:\Windows\NTDS\*.log.

And reboot normally.

However, you may also want to defrag the database while in DSRM:

  • Open a Command Prompt (Win-R, CMD, Enter). Type NTDSUTIL and press Enter.
  • Type activate instance ntds and press Enter.
  • Type Files and press Enter.
  • Type Info and press Enter. Verify the folder is actually C:\Windows\NTDS.
  • Type Compact to <path> and press Enter. I created C:\Windows\NTDS\Temp and used that.
  • Copy the new file Ntds.dit in the temp folder over top of the old one in NTDS, and delete all the *.log files.

Reboot normally.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.