ERROR_DS_DS_REQUIRED (0X0000211E) Fix: Directory Service Missing

Quick answer

Rejoin the machine to the domain, or if it's a domain controller, promote it again — the AD database (NTDS.DIT) is missing or corrupt.

What's actually happening here

ERROR_DS_DS_REQUIRED (0X0000211E) is Windows telling you that a directory service — typically Active Directory Domain Services — is required for the operation you tried, but it can't be found. The system checked for a local AD instance or a reachable domain controller, and got nothing back. This happens most often in two scenarios:

• You're on a domain-joined machine that's lost its secure channel to the domain controller — the machine account password is stale, the DC is down, or the machine was disconnected from the domain ungracefully.
• You're on a domain controller where the NTDS.DIT database file is missing, corrupt, or the AD DS service itself has failed to start — possibly after a botched restore or a drive failure.

The reason this error code exists is that many LDAP-based tools and management consoles (like Active Directory Users and Computers, or dsquery) will crash with this exact code if the underlying directory service endpoint isn't listening on port 389 or 636. It is not a generic network error — it means the directory service was expected and absent.

Fix it: Step by step

1. Check if the AD DS service is running. On a domain controller, open Services.msc and look for "Active Directory Domain Services". If it's stopped, start it. If it fails to start, look in the Directory Service event log — you'll see NTDS error codes that point to a database problem. The fix is then a database repair or restore from backup.
2. Test DNS resolution for the domain. Run nslookup yourdomain.com and nslookup _ldap._tcp.dc._msdcs.yourdomain.com. If these fail, your DNS settings are wrong — point the NIC to the correct internal DNS server (the DC itself, not an external one). This is the most common cause on domain-joined workstations.
3. Verify the machine's secure channel. On the affected machine, run nltest /sc_query:yourdomain.com. If it reports a failure or a trust relationship error, reset the machine account: netdom resetpwd /s:yourdc.yourdomain.com /ud:yourdomain\administrator /pd:*. Then reboot.
4. Rejoin the domain if steps 1-3 don't work. Remove the machine from the domain, reboot, join again as a new member. This regenerates the machine account password and re-establishes the secure channel. Yes, it's disruptive — but it's the nuclear option that fixes a broken trust relationship.

Alternative fixes when the main steps fail

If you're dealing with a domain controller that won't start AD DS:

• Directory Services Restore Mode (DSRM). Boot into DSRM by pressing F8 during startup (or using bcdedit /set safeboot dsrepair). From there, you can run ntdsutil and perform a semantic database analysis or repair. The command is: ntdsutil "activate instance ntds" "files" "integrity" quit quit. If that reports corruption, restore from a known-good backup.
• Check if the NTDS.DIT file exists. Default location is C:\Windows\NTDS\ntds.dit. If it's missing, someone deleted it or the drive failed. You'll need to recover from backup or demote and re-promote the DC.
• Firewall rules. On both client and server, ensure Windows Firewall allows inbound LDAP (TCP 389) and LDAPS (TCP 636). The rule is usually enabled by default when AD DS is installed, but a third-party firewall or security policy could block it.

Prevention tip

The biggest cause of this error is unclean domain removal — when someone pulls a machine from the domain without using the proper leave-domain wizard, or when a DC is forcibly demoted without dcpromo cleanup. Always use the Systems Control Panel or PowerShell Remove-Computer to leave a domain cleanly. On DCs, never delete the NTDS folder manually. Run regular backups of C:\Windows\NTDS and the System State so you can restore AD DS without a full rebuild.