Fix STATUS_DS_OID_NOT_FOUND (0XC000A088) in Active Directory

What's this error about?

You're seeing STATUS_DS_OID_NOT_FOUND (0XC000A088) in Active Directory. It means something in your directory is looking for an OID (Object Identifier) that doesn't exist. This usually happens during replication or when an application tries to use a custom schema attribute.

I had a client last month whose print server integration completely broke after a schema update went bad. Their event log was full of 0XC000A088. The fix was simple once we found the right steps.

Let's start with the easiest fix - you can do this in 30 seconds.

Quick fix (30 seconds) - Check the OID in ADSI Edit

Open ADSI Edit on a domain controller. Right-click ADSI Edit in the console tree and select Connect to. Make sure Configuration is selected.

1. Navigate to CN=Schema,CN=Configuration,DC=yourdomain,DC=com
2. Drill down into CN=Schema and find the attribute or class that's throwing the error.
3. Look for the attributeID or schemaIDGUID property.

If you see a missing GUID or a blank OID, you've found the problem. Some apps create attributes with temporary OIDs that expire. I've seen this with Exchange and Lync migrations.

Fix it: Right-click the attribute, go to Properties, and update the attributeID to a valid OID. If you don't know the right OID, check the application's documentation. Or, if the attribute isn't needed anymore, delete it (but be careful - deleting schema objects can break things).

Moderate fix (5 minutes) - Re-register the schema

If the quick fix didn't work, the schema might be corrupted during a bad update.

Step 1: Run this command as Administrator on a domain controller:

ldifde -f export_schema.ldf -s localhost -d CN=Schema,CN=Configuration,DC=yourdomain,DC=com -p subtree -r (objectClass=*)

Step 2: Check the export for any rows with missing OIDs. Look for lines that have attributeID: or objectClass: with no value after the colon.

Step 3: If you find a blank OID, it's usually from a third-party app that didn't register properly. I had a case where a backup software left a stubbed attribute. Delete that attribute using ADSI Edit if it's not in use.

Step 4: After cleaning, run repadmin /syncall to force replication and see if the error clears.

Advanced fix (15+ minutes) - Restore the schema from backup

If the above steps don't work, the schema is likely hosed. You'll need to restore it from a backup.

WARNING: This requires a full system state restore. Do this only on one domain controller at a time, and only if you have a good backup from before the error started.

Step 1: Restart the domain controller in Directory Services Restore Mode (DSRM).

1. Restart the server and press F8 before the Windows logo appears.
2. Select Directory Services Restore Mode.
3. Log in with the DSRM password.

Step 2: Use Windows Backup or your backup software to restore the system state from a date before the error. This restores the AD database, including the schema.

Step 3: After the restore, boot normally. Run repadmin /syncall /AdeP to check replication. If you get any errors, you might need to do an authoritative restore of the schema partition.

Pro tip: If you have more than one domain controller, restore only one. The others will catch up. But if the error is widespread, you might need to restore all of them from the same backup point.

Other things that work sometimes

• Run a schema validation with schvalidate.exe (from the Windows ADK). It checks for missing OIDs.
• Check for phantom objects in AD using repadmin /prune.
• Update your schema if a recent application install didn't finish. I saw this with a SharePoint 2016 deployment.

If none of these fix it, you're looking at a rebuild of the affected domain controller. But that's rare - 9 out of 10 times, the quick fix gets you there.