Fix AD Error 0X0000218D: SPN Derivation Without Server Ref

Cause 1: A Domain Controller Was Deleted Without Demotion

What's actually happening here is that Active Directory can't compute service principal names (SPNs) for a domain controller because the serverReference attribute on its computer object points to a deleted server object in the CN=Servers,CN=Default-First-Site-Name,CN=Sites container. This happens when someone removes a DC from AD by deleting its computer account instead of running dcpromo /demote (or Remove-ADDomainController in PowerShell). The serverReference becomes a dangling link.

The error shows up in the Directory Services event log as event ID 1925 or 1926, and replication between DCs starts failing. You'll also see it in dcdiag /test:replications output. This is the most common trigger — someone cleaned up an old DC by deleting the computer object via AD Users and Computers.

Fix: Reanimate the Deleted Server Object

You can restore the server object from the AD tombstone using ntdsutil. This works if the deletion happened within the tombstone lifetime (default 180 days for Server 2016+).

1. Open an elevated command prompt on a domain controller.
2. Type ntdsutil and press Enter.
3. At ntdsutil: prompt, type activate instance ntds and press Enter.
4. Type authoritative restore and press Enter.
5. Type restore object "CN=DCNAME,CN=Servers,CN=Default-First-Site-Name,CN=Sites,DC=yourdomain,DC=com" and press Enter. Replace DCNAME with the actual server name.
6. Confirm the restore. The utility reanimates the object from the tombstone.
7. Type quit twice to exit ntdsutil.
8. Reboot the affected DC.

The reason step 5 works is that authoritative restore increments the object's version number so it replicates back to other DCs even if they have a higher USN. After the restore, serverReference points to a live object again, and SPN derivation proceeds normally.

If you don't know the full DN of the server object, run repadmin /showattr * "CN=Servers,CN=Default-First-Site-Name,CN=Sites,DC=yourdomain,DC=com" /filter:"(objectClass=server)" /atts:cn to list all server objects. Look for the missing one.

Cause 2: The serverReference Attribute Points to a Wrong DN

Sometimes the serverReference attribute on the computer object has a malformed DN — maybe a typo from a manual edit or an incomplete replication from a legacy DC. The error code is identical (0X0000218D), but the underlying issue is a broken link rather than a missing object. This crops up after domain renames or site topology changes.

I've seen this when someone moved a DC between sites using AD Sites and Services but didn't wait for replication. The serverReference still points to the old site's servers container.

Fix: Correct the serverReference Attribute

You need to set it to the correct DN of the server object. Use ADSI Edit — it's dangerous, but precise.

1. Open ADSI Edit and connect to the Default naming context.
2. Navigate to the computer object: CN=DCNAME,CN=Computers,DC=yourdomain,DC=com.
3. Right-click it → Properties. Find serverReference.
4. Note the current value. It should look like CN=DCNAME,CN=Servers,CN=Default-First-Site-Name,CN=Sites,DC=yourdomain,DC=com.
5. If it's wrong, copy the correct DN from a working DC's serverReference (compare with another DC's attribute). Paste it in and click OK.
6. Force replication with repadmin /syncall /AdeP.

A quick way to check: run dsquery * -filter "(&(objectClass=computer)(name=DCNAME))" -attr serverReference. If it returns nothing or a garbage path, you've found the cause.

Cause 3: Schema Conflict After Domain Functional Level Upgrade

Less common but real: after raising the domain functional level from Server 2008 R2 to Server 2016 or higher, the schema update may not propagate the serverReference attribute correctly on some DCs. The error appears during the gpupdate /force or klist -li 0x3e7 purge operations. It's a mismatch between the expected attribute syntax (DN-String) and the actual stored value.

Fix: Schema Refresh via Repadmin

1. Check schema version: dsquery * cn=schema,cn=configuration,dc=yourdomain,dc=com -scope base -attr objectVersion. Should be 88 for Server 2016, 69 for Server 2012 R2, etc.
2. Force schema replication: repadmin /syncall /d /e /P /q.
3. If the error persists, update the attribute manually via ADSI Edit on the Configuration partition:
4. Go to CN=Schema,CN=Configuration,DC=yourdomain,DC=com → find CN=Server-Reference.
5. Check that attributeSyntax is 2.5.5.12 (DN-String) and isSingleValued is TRUE. If they differ from a healthy DC, update them.

I don't recommend this unless you're certain the schema is inconsistent across DCs. In most cases, cause 1 or 2 is the culprit.

Quick-Reference Summary