What does Windows error code 8603 (ERROR_DS_CANT_DERIVE_SPN_FOR_DELETED_DOMAIN) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: ERROR_DS_CANT_DERIVE_SPN_FOR_DELETED_DOMAIN the DS cannot derive a service principal name (SPN) with which to mutually authenticate the target server.

Previous	Next
ERROR_DS_CROSS_REF_BUSY	ERROR_DS_CANT_DEMOTE_WITH_WRITEABLE_NC

ERROR_DS_CANT_DERIVE_SPN_FOR_DELETED_DOMAIN

ERROR_DS_CANT_DERIVE_SPN_FOR_DELETED_DOMAIN (8603) is an Active Directory Domain Services error. The directory service tried to derive a Service Principal Name for a target server, but the server domain referenced by the directory has been deleted. This usually indicates stale domain-controller metadata, an abandoned domain, or a reference that survived a domain-removal operation.

What to check

Verify whether the referenced domain should still exist in the forest.
Inspect DC and partition metadata before changing SPN values.
Use the documented domain or DC metadata cleanup process only after confirming that the old domain or controller is permanently gone.

Useful command

setspn -L "<ComputerAccount>"

Microsoft: Configure Service Principal Names · Microsoft: Clean up AD DS server metadata · Microsoft: Directory Service system error codes

Looking for a different code? Search another status or error code.