STATUS_BACKUP_CONTROLLER 0XC0000187 fix for Windows Server

Quick answer: Run netdom query fsmo to find the PDC emulator, then move the roles to this server with ntdsutil, or demote and re-promote the server.

I know this error is infuriating. You try to create a user or change a group policy on a domain controller, and boom — STATUS_BACKUP_CONTROLLER (0xC0000187). The message says "This operation is only allowed for the primary domain controller of the domain."

This tripped me up the first time too. It happens when your server holds the Backup Domain Controller (BDC) role from older Windows versions (NT4 era) or when Active Directory replication got messed up. In modern Windows Server (2008 through 2022), there's no real BDC role — but the error still appears if the server thinks it's a standby instead of the primary.

I've seen this most often when someone demoted a server incorrectly, or when the FSMO role holder for PDC emulator was seized and the old server still has stale metadata.

Fix 1: Check and move the PDC emulator role

1. Open Command Prompt as Administrator on the server getting the error.
2. Type netdom query fsmo and press Enter. Look for the line that says "PDC" — it shows the current PDC emulator owner.
3. If the owner is not this server, you need to transfer the role. Run ntdsutil:

ntdsutil
activate instance ntds
roles
connections
connect to server <CurrentPDCServerName>
quit
transfer PDC

Replace <CurrentPDCServerName> with the name you saw in step 2. Say "yes" to confirm. This moves the PDC emulator to the server throwing the error.

If the connection fails, the current PDC might be offline. Then you seize the role:

seize PDC

Only seize if the old PDC is dead and never coming back. Seizing creates lingering objects.

Fix 2: Demote and re-promote the server

If moving the role doesn't stop the error, the server's own configuration is corrupted. Skip the role transfer and just rebuild it:

1. Open Server Manager, click Manage > Remove Roles and Features.
2. Uncheck Active Directory Domain Services. It will warn you about demoting the domain controller. Click Demote this domain controller.
3. In the wizard, check Force the removal of this domain controller (only if other DCs exist).
4. Reboot the server.
5. After reboot, add the AD DS role back and promote it again using Add a new domain controller to an existing domain.

This clears any stale BDC metadata that was stuck in the registry.

Alternative fix: Clean up lingering server references

Sometimes the error comes from old NT4-style entries in Active Directory. Use ADSI Edit:

1. Open adsiedit.msc.
2. Connect to the domain partition (default naming context).
3. Navigate to CN=Servers,CN=<YourSite>,CN=Sites,CN=Configuration,DC=<yourdomain>.
4. Find the server object for the machine throwing the error. Right-click it and choose Properties.
5. Look for an attribute called operationRole or primaryGroupID — if it's set to BACKUP_DOMAIN_CONTROLLER (value 2), change it to PRIMARY_DOMAIN_CONTROLLER (value 1).

I once found a server with a rogue primaryGroupID of 521 (read-only DC) mixed with full DC role — that also triggered this error.

Prevention tip

Never demote a domain controller by just turning it off or deleting it from AD. Always use the proper demotion wizard. If you need to force-remove a DC (because it's crashed), immediately clean up its metadata using ntdsutil metadata cleanup within 24 hours. Stale BDC references linger and cause this error months later.