Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Error 0xC00002E2 is the Windows Server stop code STATUS_DS_INIT_FAILURE. It means Active Directory Domain Services (AD DS) could not start because the server cannot open or initialize its local directory database, usually NTDS.DIT. The practical fix is to work offline in Directory Services Restore Mode (DSRM), verify that the database volume is attached, online and has free space, then choose the recovery branch that matches the cause. Do not delete or rename NTDS.DIT or force-demote the server before you know whether another domain controller and a usable system-state backup exist.
What does Error 0xC00002E2 mean?
Microsoft identifies 0xC00002E2 as STATUS_DS_INIT_FAILURE. The associated message is that the directory service could not start. This is an Active Directory domain-controller failure, not a normal Windows desktop error. A domain controller must read its local AD database before it can provide normal authentication, and a failure at that stage prevents the directory service from starting.
As an Amazon Associate I earn from qualifying purchases.
The immediate diagnostic target is the volume and file that contain NTDS.DIT. Microsoft lists several possible causes: the storage is inaccessible, the volume is full, the database file is missing, a non-operating-system disk was left offline by SAN policy, or the database is damaged. The same stop condition can therefore represent a simple storage problem or a serious directory-recovery event.
Because AD DS is unavailable, the Local Security Authority Subsystem Service (LSASS) can trigger an automatic restart. Repeated normal boots usually do not repair the underlying condition and can make it harder to observe the server long enough to diagnose it. Plan to inspect the machine offline.
Popular on Amazon
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
What should you do before changing the server?
Protect your recovery options before making any destructive change. A forced demotion, metadata cleanup or domain recreation can have identity and data consequences, especially when this is the only domain controller.
- Record the exact code and message. Photograph the screen or save the boot-diagnostics output. Confirm that the hexadecimal value is
0xC00002E2and that the surrounding text refers to the directory service. - Identify the platform. Note whether the controller is physical or virtual, which disks should contain AD data, and whether storage was recently moved, detached, resized or presented through a SAN.
- Check the domain topology. Determine whether another writable domain controller is serving the domain. This single fact changes the safe recovery path.
- Locate your backups. Confirm the date and usability of the most recent system-state backup for this controller or domain. Do not assume that a copied folder or ordinary file backup can substitute for a documented system-state recovery.
- Do not alter the database yet. Do not delete, rename, replace or run an unplanned repair operation against
NTDS.DITbefore establishing a restore or recovery path.
How do you start Directory Services Restore Mode?
Use Directory Services Restore Mode (DSRM) so AD DS remains stopped while you inspect its files and storage. The exact screens vary by Windows Server release, firmware and whether the server is physical or virtual, but the recovery or Startup Settings path should offer Directory Services Restore Mode.
- Restart the server and enter Windows Recovery or the server’s Startup Settings. On a system that can reach the Windows recovery menus, use Troubleshoot, then Advanced options, and select the startup option for Directory Services Restore Mode when it is presented.
- Sign in with the DSRM password, not a normal domain-user password. AD DS is intentionally not started in this mode.
- If the machine is a virtual server, verify the virtual disks are attached to this particular virtual machine before proceeding. If it is physical, check the controller, cabling and storage presentation using your normal hardware-management procedures.
- Keep a written record of every disk and volume you inspect. That record helps distinguish a missing database disk from a database that is present but unreadable.
If DSRM is not available through the normal boot menus, use the server’s documented Windows Recovery or Startup Settings procedure rather than repeatedly allowing the controller to crash and restart.
How do you locate NTDS.DIT and verify the database volume?
Once signed in to DSRM, use ntdsutil to ask the directory service tools where the active database is stored. This identifies the database path and the volume information without guessing from drive letters.
ntdsutil
activate instance ntds
files
infoReview the output carefully. It should show the location of the directory database and associated file information. Compare that location with the disks that the operating system currently sees.
- Database disk missing: Check the virtual-disk attachment, storage presentation, controller status and cabling. A drive-letter change alone does not prove that the intended volume is available.
- Database disk present but offline: Bring the correct disk online using your organization’s approved storage-management process. Microsoft specifically identifies SAN policy as a cause when a non-OS disk remains offline.
- Database volume is full: Free space on the volume reported by
ntdsutil, not on an unrelated system volume. Preserve evidence and change records while removing only data that your retention policy allows you to remove. - Database file is absent: Stop before creating a replacement file or copying one from an unknown source. A missing directory database requires the documented system-state or domain-controller recovery plan.
After correcting an attachment, online-state or capacity issue, confirm that the path and file are visible again in DSRM. Then attempt one controlled normal boot. If the same stop code returns, return to DSRM and continue with the branch for a missing or corrupt database rather than repeating the boot indefinitely.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11What if the volume is offline, inaccessible or out of space?
Storage access and capacity are the least destructive causes to correct because they can preserve the existing directory database. Work through them in an order that avoids changing the database itself.
Also popular on Amazon
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Attach the intended disk
For a virtual controller, check the hypervisor’s hardware settings and confirm that the disk containing the AD database is attached to the correct server. For a physical controller, verify the storage array presents the expected logical unit and that the server’s storage controller reports it as healthy. If a disk was replaced or restored, confirm that the restored volume is the one identified by ntdsutil.
Bring the disk online
A non-OS disk can remain offline because of a SAN policy. Use the approved disk-management method for your Windows Server build to place the correct disk online. Do not initialize, format or recreate a volume merely because it is not visible in Explorer; those actions can destroy the database you are trying to preserve.
Free space safely
If the database volume is full, remove or move only data that is covered by your organization’s retention and change-control rules. Temporary files and application data may be candidates, but do not delete AD database files, transaction logs or system-state components as a first reaction. Once meaningful free space is available, record what changed and retry a controlled boot.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →If the disk is online, has capacity and the database path still cannot be read, treat the condition as a possible missing or corrupt NTDS.DIT. Storage cleanup alone will not repair a damaged directory database.
What should you do if NTDS.DIT is missing or corrupt?
There is no universal, risk-free database-repair command in the Microsoft guidance for this stop code. A database that is missing or corrupt must be handled through the organization’s system-state or domain-controller recovery plan, with escalation to an administrator experienced in AD DS recovery when the plan is unclear.
- Preserve the original disks and logs. Do not overwrite the volume with a newly created directory database.
- Identify the newest verified system-state backup and its restore instructions.
- Confirm whether another domain controller has a current, writable copy of the directory and whether DNS, SYSVOL and replication services remain available there.
- Record the event-log details available in DSRM or the recovery environment. Microsoft directs administrators to inspect the event logs because they can identify the specific file, volume or initialization failure.
- If the database is the only copy of the domain and no usable system-state backup exists, pause before any forced-removal action. Recreating the domain may be the only remaining route, and it will not preserve the original domain identity automatically.
Do not treat a successful login to DSRM as proof that the directory is healthy. DSRM is an offline recovery state; it exists precisely because normal AD DS operation is unavailable.
How do you recover when the AD DS role was removed without demotion?
If the Directory Services Domain Controller role was removed improperly, the recovery sequence is different from a storage repair. Microsoft documents restoring the role, returning to DSRM, using a forced-removal command, and then cleaning up the controller’s metadata. This is a conditional procedure for supported Windows Server versions, not a first-line response to every 0xC00002E2 screen.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsAlso popular on Amazon
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Restore the AD DS role
From the affected server’s recovery or administrative environment, enable the Directory Services Domain Controller feature with the documented command:
dism.exe /online /enable-feature /featurename:DirectoryServices-DomainControllerUse the command only when you have established that the role was removed and that restoring it is part of the approved recovery plan. A role that is already present does not need to be enabled again simply because the database failed to initialize.
Return to DSRM and force removal when appropriate
After the role is restored, boot back into DSRM and run the later-version PowerShell command Microsoft documents for forced removal:
Uninstall-AddsDomainController -ForceRemovalForced removal severs this server’s domain-controller role; it does not magically repair a corrupt database. It is generally considered only when another domain controller can continue the domain or when the recovery plan explicitly calls for removing the failed controller.
Recommended Free Tools
Clean up metadata
A forced removal leaves references to the old controller in the directory. Clean up that metadata using your organization’s documented Active Directory procedure before attempting to reuse the server name or promote the machine again. Coordinate DNS, SYSVOL and replication changes with the administrators of the remaining controllers.
What changes if this is the only domain controller?
An only-domain-controller failure is the highest-risk branch. If a verified system-state backup exists, restore the most recent suitable backup according to the organization’s domain-controller recovery procedure. This preserves a recovery path for the directory that is already authoritative for the domain.
Do not casually run forced removal when there is no other controller. A forced demotion can discard the only available copy of the domain’s directory data. Microsoft warns that, without a usable backup, the organization may have to recreate the domain; that outcome requires rebuilding identities, trust relationships, DNS integration and dependent services.
Also popular on Amazon
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Before restoring, verify the backup date, storage location, recovery credentials and any application dependencies. Keep the failed server’s original media intact until the restore is confirmed. If the backup cannot be validated or the database is badly damaged, involve a specialist rather than experimenting with undocumented database edits.
Free tools Windows power users keep installed
One-click scans. No signup required.
What changes when other domain controllers exist?
With another healthy domain controller available, the organization can consider forced demotion of the failed server, metadata cleanup and later promotion. The presence of another controller reduces the risk of losing the domain’s only directory copy, but it does not eliminate the need for change control.
- Confirm that at least one other controller is serving authentication and that the domain’s DNS, SYSVOL and NETLOGON functions are available there.
- Capture the failed controller’s name, IP addresses, site, roles and the event details from DSRM.
- Decide whether preserving this server’s database is still feasible. If the storage issue is repairable, repairing it is less disruptive than demotion.
- If forced removal is approved, use Microsoft’s documented sequence, then remove stale controller metadata and DNS records according to your directory-management procedure.
- Monitor the remaining controllers and replication after cleanup. Promote the repaired or rebuilt server again only after the domain is stable and the prerequisites have been checked.
The choice is consequential even in a multi-controller domain: demotion changes the server’s identity in the directory, while a storage repair attempts to preserve it.
How do you validate the server after it boots?
A normal boot is only an intermediate result. Validate the directory before returning the controller to production.
- Review the Directory Service event log for initialization, database, authentication and replication errors.
- Confirm that the AD DS service starts and remains running after a restart.
- Check that the controller’s DNS service answers the records required by the domain.
- Verify that SYSVOL and NETLOGON are shared and available to clients.
- Run the organization’s standard domain-controller and replication checks from a known-good administrative system.
- Test authentication with a controlled account and confirm that dependent applications can locate the controller.
- Document the original cause, the storage or recovery changes, the backup used and any follow-up monitoring.
If event logs show continuing database or replication errors, take the controller out of service again and follow the recovery plan. Do not interpret one successful login as proof that all directory functions have recovered.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Which recovery choice is safest?
The right action depends on data preservation, domain topology, certainty about the cause, and reversibility. Use this comparison before approving a change.
| Situation | Preferred first action | Data impact | Why it matters |
|---|---|---|---|
| Database disk detached or offline | Attach or bring the correct volume online in DSRM | Usually preserves the existing database | The stop code can result from storage presentation or SAN policy rather than corruption. |
| Database volume full | Free policy-approved space on the volume identified by ntdsutil |
Preserves the database if files are not deleted | Capacity can prevent initialization even when the database itself is sound. |
| NTDS.DIT missing or corrupt | Use a documented system-state or domain-controller recovery plan | Depends on the backup and recovery method | Microsoft does not prescribe one universal repair command for corruption. |
| AD DS role removed improperly | Restore the role, then follow the approved forced-removal and metadata-cleanup sequence | Changes the controller’s directory identity | Role restoration and forced removal are conditional steps, not generic fixes. |
| Only domain controller | Restore system state when possible | Best chance of preserving the domain | Forced removal can destroy the only copy; without backup, domain recreation may be required. |
| Other domain controllers available | Repair storage if possible; otherwise consider forced demotion and cleanup | Demotion is consequential but the domain can continue elsewhere | A surviving controller provides continuity while the failed server is rebuilt or repromoted. |
What mistakes should you avoid?
- Applying desktop troubleshooting. Driver reinstalls, consumer startup repair and unrelated Windows cleanup do not address an AD database that cannot initialize.
- Deleting NTDS.DIT or transaction logs as a shortcut. Removing directory files can eliminate the only recoverable copy.
- Formatting a disk that appears offline. An offline SAN disk is not an empty disk; initialize or format it only when the recovery plan explicitly requires it.
- Force-demoting the only controller. Check topology and backups first.
- Assuming free space on C: solves the problem. The relevant volume is the one that actually hosts
NTDS.DIT. - Ignoring event logs after a successful boot. Initialization may succeed while DNS, SYSVOL or replication remains broken.
- Repeating automatic restarts. LSASS can restart the computer when AD DS cannot initialize; repeated attempts do not replace offline diagnosis.
As an optional shortcut after the manual checks, Outbyte PC Repair can look for more than 100 common Windows issues, adjust settings and clean temporary or cache files. It runs on Windows 11, 10, 8 and 7, offers a free trial by category for at least two days before a paid subscription, complements an antivirus rather than replacing one, and results vary; no tool repairs every domain-controller failure.
FAQ
Can a regular Windows 11 desktop show 0xC00002E2?
The documented code is associated with an Active Directory domain controller. If a consumer PC shows a different message containing the letters “DS,” verify the complete hexadecimal code and the product named in the message before using this procedure.
Also popular on Amazon
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Does repeatedly restarting give Windows a chance to repair the controller?
No. When AD DS cannot initialize, LSASS can force an automatic restart, so the machine may loop without reaching a usable domain-controller state. Capture the exact error and move to DSRM for offline inspection instead.
What information should I collect before escalating the incident?
Provide the exact stop code, event-log details, the ntdsutil database path, the list of attached and offline disks, recent storage changes, the number of domain controllers, and the date of the latest verified system-state backup. This lets the recovery team choose between storage repair, restore and demotion without guessing.
Is a normal file copy equivalent to a system-state backup?
Not for this recovery decision. The documented branch for an unavailable or corrupt directory database is a system-state or domain-controller recovery plan, so treat an ordinary file copy as supplemental evidence rather than assuming it can restore AD DS.
When should you stop troubleshooting and call an AD DS specialist?
Escalate when the database is missing or corrupt, the only domain controller has no verified system-state backup, storage repairs could overwrite the original volume, or the recovery plan would require forced removal or domain recreation. Those choices are difficult to reverse and can affect every identity and service that depends on the domain.
Frequently Asked Questions
Can a regular Windows 11 desktop show 0xC00002E2?
The documented code is associated with an Active Directory domain controller. If a consumer PC shows a different message containing the letters “DS,” verify the complete hexadecimal code and the product named in the message before using this procedure.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Does repeatedly restarting give Windows a chance to repair the controller?
No. When AD DS cannot initialize, LSASS can force an automatic restart, so the machine may loop without reaching a usable domain-controller state. Capture the exact error and move to DSRM for offline inspection instead.
What information should I collect before escalating the incident?
Provide the exact stop code, event-log details, the ntdsutil database path, the list of attached and offline disks, recent storage changes, the number of domain controllers, and the date of the latest verified system-state backup. This lets the recovery team choose between storage repair, restore and demotion without guessing.
Is a normal file copy equivalent to a system-state backup?
Not for this recovery decision. The documented branch for an unavailable or corrupt directory database is a system-state or domain-controller recovery plan, so treat an ordinary file copy as supplemental evidence rather than assuming it can restore AD DS.
When should you stop troubleshooting and call an AD DS specialist?
Escalate when the database is missing or corrupt, the only domain controller has no verified system-state backup, storage repairs could overwrite the original volume, or the recovery plan would require forced removal or domain recreation. Those choices are difficult to reverse and can affect every identity and service that depends on the domain.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
