This article was previously published under Q328775
If you try to delete the computer account for the domain controller in Active Directory Users and Computers, you may receive the following error message:
Error: DSA object cannot be deleted
This problem occurs if you delete the computer account after you have demoted the domain controller by running the dcpromo process on it.
This problem occurs if the value of UserAccountControl is set to 8192.
To resolve this issue, change the value of UserAccountControl to 4096.
NOTE: Use this resolution only if one of the following is true:
You have demoted the domain controller by running the dcpromo utility on it.
The computer hardware failed, you used the ntdsutil process to clean the account's metadata, and then you deleted the account from Active Directory Sites and Services, but you still cannot delete the computer account.
Click Start, point to Programs, point to Windows 2000 Support Tools, point to Tools, and then click ADSI Edit.
Expand Domain NC, expand dc=domain,dc=com, and then expand ou=domain controllers.
Right-click the computer name of the domain controller, and then click Properties.
On the Attributes tab, select both properties in the Select which properties to view list box.
In the Select a property to view list box, select UserAccountControl.
Under Attribute Value, view the value. Make the value 4096 to give the computer account member server status so that you can delete it.
Type 4096 in the Edit Attribute box.
Click the Set button.
Click Apply, and then click OK. Quit ADSI Edit.
For additional information about metadata cleanup, click the following article numbers to view the articles in the Microsoft Knowledge Base:
216498 HOW TO: Remove Data in Active Directory After an Unsuccessful Domain Controller Demotion
230306 HOW TO: Remove Orphaned Domains from Active Directory
332199 Domain controllers do not demote gracefully when you use the Active Directory Installation Wizard to force demotion in Windows Server 2003 and in Windows 2000 Server