Active Directory policy error 0x000021AA fix

When this error hits

You're rebooting a domain controller running Windows Server 2016 or newer. Right after the Windows logo, the screen goes black with the error: 0x000021AA (ERROR_DS_POLICY_NOT_KNOWN). The server won't finish booting into normal mode. Usually this happens after a botched Group Policy update, a failed sysvol replication, or someone deleted a policy object from ADSI Edit by accident. I've seen it most often after a domain controller restore from backup that missed the policy container.

What's causing it

The short version: Active Directory can't find the default domain policy or domain controllers policy object. These are stored in the CN=Policies,CN=System,DC=yourdomain,DC=com container. If that container is empty, has corrupted entries, or the GPT.INI file in sysvol is missing, the directory service refuses to start. The error code 0x000021AA is the kernel telling you "I can't enforce policy, so I'm stopping."

Don't bother reinstalling the server. That's the slow path. The real fix is to boot into Directory Services Restore Mode (DSRM) and repair the policy objects using ntdsutil or manually recreate them.

Fix steps

1. Boot into DSRM. Hit F8 during startup and select Directory Services Restore Mode. If you've got a newer server with secure boot, you might need to interrupt the boot process three times to trigger automatic repair, then pick DSRM from advanced options. Use the DSRM password you set when promoting this DC — you did write it down, right?
2. Open a command prompt as Administrator. Don't bother with PowerShell for this — ntdsutil is old school but reliable.
3. Run this command to reset the policy objects:

   ntdsutil
   activate instance ntds
   authoritative restore
   restore object "CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=yourdomain,DC=com"
   restore object "CN={6AC1786C-016F-11D2-945F-00C04fB984F9},CN=Policies,CN=System,DC=yourdomain,DC=com"
   quit
   quit

   This marks those two policy objects as authoritative during the next replication. Replace yourdomain.com with your actual domain.

4. Reboot normally. Let the server come up. It should now start. If it doesn't, move to step 5.
5. If step 3 fails, the objects might be completely missing. You'll need to recreate them manually. Boot back into DSRM and use ADSI Edit to connect to the domain NC. Navigate to CN=System,CN=Policies. Create the two GUID-named containers if they're absent. Then copy the default policy files from another DC's sysvol (\otherDC\SYSVOL\domain\Policies\{GUID}) to this server's sysvol.
6. After that, run the authoritative restore again from step 3. This forces the restored objects to replicate out.

One more thing: if you've got multiple DCs, run repadmin /syncall from a working DC after you get this one back online. That ensures the policy data spreads everywhere.

What to check if it still fails

If the server still won't boot after these steps, you're looking at a deeper issue. First, check the event log in DSRM — look for event ID 1006 from NTDS or 1058 from GroupPolicy. That'll tell you the exact object it can't find. Second, verify that %SystemRoot%\SYSVOL\domain\Policies\{GUID}\GPT.INI exists and is readable. If GPT.INI is missing, create it with a text editor and put in these two lines:

[General]
Version=2

Third, if you're on Server 2022 with the latest patches, I've seen a bug where the policy container gets corrupted after a failed update. In that case, boot into DSRM, open a command prompt, and run sfc /scannow followed by dism /online /cleanup-image /restorehealth. Yes, even on a domain controller. I've had that fix it twice.

Last resort: demote the DC using dcpromo /forceremoval from a recovery command prompt, then re-promote it. That's a nuclear option but it works if the policy database is completely hosed. Just be ready to wait for replication to catch up.