Fix Windows Error 0x00002153: Directory Service Won’t Start

Error 0x00002153 with “Directory Service cannot start” usually appears when Windows cannot start Active Directory Domain Services (AD DS), most often on a domain controller. The steps below help identify the cause and recover the service safely; they are not intended for a regular home PC that is not configured as a domain controller.

What You’ll Need

Sign-in access to the affected server with local administrator privileges.
A second domain controller or a verified system-state backup, if available.
Access to the server console or out-of-band management. Avoid relying only on Remote Desktop if you may need Directory Services Restore Mode (DSRM).
The DSRM password, if you need to start in that recovery mode.
Time to record the exact error and review logs before making changes.

Step-by-Step

Confirm this is a domain controller. AD DS is a server role, not a normal Windows sign-in service. If this is a personal Windows 10 or 11 PC and it is not a domain controller, do not follow database-repair steps or delete files. Check the full message and the application or service that displayed it; the code may belong to that component rather than Windows AD DS. Contact your organization’s IT administrator if the device is managed.
Record the situation and check for a safe recovery path. Note when the failure began, any recent updates, shutdowns, storage issues, or configuration changes. Identify whether another healthy, writable domain controller exists and whether this server has a current system-state backup. If another controller is available, verify that users and essential services can use it. Do not perform a restore or seize directory roles based only on this message.
Check available disk space and recent system events. Sign in with an administrative account or use the server console. Open Event Viewer and inspect Windows Logs > System and Applications and Services Logs > Directory Service. Look at events recorded around the failed startup, noting their source, event ID, and full text. Also verify that the system volume and the volume holding the AD database and logs have free space and are accessible. Do not delete database or log files to make room.
Try a normal restart only if it is safe. If the server is not in the middle of a restore, update, or other recovery operation, arrange a maintenance window and restart it once from Windows. A transient storage or startup issue may clear. If the same error returns, stop repeating restarts and use the event details to guide the next step. On a multi-controller domain, check replication health before and after any recovery action.
Start in Directory Services Restore Mode (DSRM) when logs indicate AD DS database recovery is needed. Use the server’s local console. From Windows, open an elevated Command Prompt and run bcdedit /set safeboot dsrepair, then restart. Sign in using the DSRM password, which is separate from the domain administrator password. If the command cannot be run or the server cannot boot normally, use the Windows recovery environment or your organization’s approved server recovery procedure. Do not use this step casually on a production controller.
Run a read-only database integrity check first. In DSRM, open an elevated Command Prompt and run ntdsutil. At its prompts, enter activate instance ntds, then files, then integrity. Record the output. Use quit to leave each prompt. This check can identify database problems; it does not repair them. If it reports errors, preserve the output and consult your administrator or Microsoft support before attempting database repair.
Return the server to normal startup. If you used the BCDEdit command and the server is still in DSRM, open an elevated Command Prompt and run bcdedit /deletevalue safeboot, then restart. If Windows reports that the setting does not exist, do not keep changing boot settings; check the current boot configuration with your administrator. Confirm whether AD DS starts and review the Directory Service log again.
Escalate based on the evidence. If the service still will not start, use a known-good system-state backup or a supported recovery process selected for your domain’s replication and role-holder situation. Restore options differ depending on whether another writable controller exists and whether this is the only controller. A qualified domain administrator should decide whether to restore, rebuild, or recover the server. Do not copy database files from another controller or force a restore without a documented plan.

Common Mistakes

Treating every 0x00002153 as an AD DS failure. The wording and the machine’s role matter. Confirm which service reports the code and whether the device is actually a domain controller.
Deleting files in the NTDS folder. The database and transaction logs are essential. Removing or renaming them can make recovery harder or cause data loss.
Using the wrong password in DSRM. DSRM uses its own password, not necessarily the domain administrator credentials.
Repairing before checking backups and other controllers. An improvised repair can create a worse outage or interfere with replication.
Repeating forced shutdowns. Repeatedly interrupting startup does not diagnose the issue and may complicate recovery.

Tips

Copy complete event text and note timestamps; a single error code rarely identifies the cause on its own.
Check storage health and recent changes, including disk failures, full volumes, updates, and abrupt power loss.
Keep system-state backups and test the recovery process according to your organization’s procedures.
For a domain with multiple controllers, verify DNS and replication health with your administrator before making changes to one controller.
Use an elevated command prompt only for commands you understand, and record the original state before changing boot settings.

Troubleshooting

The machine is not a domain controller: Stop here. AD DS database tools and DSRM are not appropriate for a standard Windows 10 or 11 computer. Capture the application name and full error, then troubleshoot that specific component or ask the device administrator.

The DSRM password is unavailable: Do not guess repeatedly or attempt password-reset workarounds. Ask the domain administrator to locate the documented recovery credential or choose another supported recovery path.

The integrity check reports corruption: Do not run undocumented database commands or delete transaction logs. Preserve the output and determine whether a healthy replica and verified system-state backup are available. Have a domain administrator assess the supported recovery option.

The server cannot boot after setting safe boot: Use the local console or Windows recovery environment, and have an administrator inspect the boot configuration. If safe boot was enabled with BCDEdit, remove that setting only when you can safely access the recovery command prompt.

The error returns after a restart: Compare the new event details with the earlier logs. Check storage, volume access, DNS, and replication conditions; then escalate with the event IDs, server role, backup status, and steps already tried. Avoid making several changes at once.

Frequently Asked Questions

What does error 0x00002153 mean?
It may accompany an AD DS startup failure, but the code alone does not establish the cause. Confirm the exact message, service, and whether the computer is a domain controller.

Can I use these steps on a regular Windows 11 or Windows 10 PC?
Not if it is an ordinary home or work PC rather than a domain controller. Do not use DSRM or NTDS database commands on it.

Will restarting fix the directory service?
Sometimes a one-time restart clears a temporary startup issue, but repeated restarts are not a repair. Review the logs if the error comes back.

Is it safe to run the integrity check?
The check described here examines the database; it is not a repair command. Run it only on the affected domain controller in DSRM and record its results.

Can I fix this by deleting AD database log files?
No. Deleting or moving those files can cause data loss or make recovery more difficult. Use a supported recovery plan instead.

When should I contact support?
Contact a qualified domain administrator or Microsoft support if the integrity check reports errors, the only domain controller is affected, backups are uncertain, or the server remains unable to start AD DS.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →