0X00002126: DST NC Mismatch Fix on Windows Server

1. Stale or Misconfigured NTDS Settings Object

This is the culprit nine times out of ten. The destination DC has an NTDS Settings object that points to a source DC that no longer exists or has a different naming context. This can happen after a failed demotion or a botched restore.

Quick check: Open adsiedit.msc and navigate to the destination DC’s NTDS Settings object. Look at the serverReference attribute. If it points to a dead server or a GUID that doesn’t match the source DC, that’s your problem.

Fix:

1. Open adsiedit.msc and connect to the Configuration partition.
2. Expand CN=Configuration, DC=yourdomain, DC=com → CN=Sites → CN=YourSite → CN=Servers → CN=DestinationDC → CN=NTDS Settings.
3. Right-click the NTDS Settings object and choose Properties.
4. Find serverReference. If it’s set to a nonexistent server, delete the attribute. Then manually set it to the correct source DC’s distinguished name (e.g., CN=SourceDC, CN=Servers, CN=YourSite, CN=Sites, CN=Configuration, DC=yourdomain, DC=com).
5. Close adsiedit and run repadmin /syncall /AdeP on the destination DC.

If adsiedit shows the attribute is correct but replication still fails: The object might be corrupt. Delete the NTDS Settings object entirely and let AD recreate it.

net stop ntds
ntdsutil
> metadata cleanup
> remove selected server DestinationDC
> quit
quit
net start ntds

After restart, the NTDS Settings object regenerates automatically. Then force replication again.

2. Stale DNS Records Pointing to an Old Source DC

When the source DC was demoted or removed improperly, its DNS records often linger. The destination DC tries to replicate using an old A record or SRV record for a DC that no longer exists. DNS scavenging helps, but it’s not instant.

Find stale records:

1. Open dnsmgmt.msc on a working DC.
2. Expand Forward Lookup Zones → yourdomain.com → _msdcs.
3. Check dc and gc subfolders. Delete any SRV records pointing to the source DC’s hostname if that DC is gone.
4. Also check the source DC’s A record in the main zone folder. Delete it if dead.

Force DNS scavenging: If you set scavenging on the zone, run this on the DNS server:

dnscmd . /StartScavenging

Wait 15 minutes then retry replication with:

repadmin /syncall /force

Still broken? Sometimes the destination DC caches old DNS data. Flush it:

ipconfig /flushdns
net stop dnscache && net start dnscache

Then run nslookup -type=SRV _ldap._tcp.dc._msdcs.yourdomain.com and verify only live DCs show up.

3. Firewall or Network Segmentation Blocking Replication

This one’s rare but happens when you’ve got firewall rules between sites that block RPC dynamic ports. AD replication uses RPC, which can pick any port in the high range (49152-65535 on newer Windows). If the firewall only allows static ports, you’ll get this error.

Check reachability:

1. From the destination DC, ping the source DC by name and IP.
2. Test RPC connectivity: rpcdump.exe from the Windows SDK or PowerShell:

Test-NetConnection -ComputerName SourceDC -Port 135

If port 135 is open but the test fails, you’ve got a dynamic port block.

Fix: Restrict RPC to a static port range on the source DC (not ideal for security, but works). Use netsh:

netsh int ipv4 add address "Ethernet" 192.168.1.10 255.255.255.0

Wait, that’s not for ports. Actually, you set the RPC port range via registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Internet
Key Name: Ports (REG_MULTI_SZ)
Value: 50000-51000
Key Name: PortsInternetAvailable (REG_SZ)
Value: Y
Key Name: UseInternetPorts (REG_SZ)
Value: Y

Reboot the source DC. Then add firewall rules for TCP 135 and the port range you set.

If you can’t reboot: Use repadmin /options +DISABLE_NETLOGON to force it to use the KCC’s failover. It’s a band-aid, not a fix.

Quick-Reference Summary Table

Start with the first cause. In my experience, 80% of 0X00002126 errors are the NTDS Settings object being wrong. DNS is next. If you’ve checked both and still stuck, then look at the firewall. Don’t waste time on other stuff like time sync or schema versions — they rarely trigger this specific error.