Fix 0X000020CF ERROR_DS_ATT_SCHEMA_REQ_ID on AD

Quick answer

Run ntdsutil metadata cleanup and restore schema from a recent backup using authoritative restore. If you can't restore, promote a new domain controller.

Why this happens

This error pops up when the Active Directory schema record for an attribute class is broken. The governsID attribute — it's the unique OID that ties a schema object to its class definition — is either missing, null, or pointing to a deleted object. I've seen this most often after a failed schema update (like a hotfix or Exchange prep) or when someone manually edited schema objects with ADSI Edit and didn't lock the schema first. The error code 0X000020CF means the Directory Service can't validate the schema record's class hierarchy. Domain controllers with this error will fail to replicate or start the NTDS service.

Fix steps

Identify the busted schema object
Open Event Viewer → Windows Logs → Directory Service. Look for event ID 1168 or 1206. The description usually lists the attribute governsID and the corrupted object's DN. Copy that DN.
Boot into Directory Services Restore Mode (DSRM)
Restart the DC, press F8 before Windows loads, select Directory Services Restore Mode. You'll need the DSRM password — if you don't have it, you're stuck. This step is non-negotiable.
Run an authoritative restore from backup
Open CMD as admin in DSRM, run ntdsutil then authoritative restore. Use restore object <DN of corrupted object> — replace <DN> with the actual DN from step 1. If you don't have a backup, skip to step 4.
If no backup: manually reset the governsID
Still in DSRM, launch adsiedit.msc. Connect to Configuration → CN=Schema,CN=Configuration,.... Find the attribute with the missing governsID. Right-click → Properties. Locate governsID attribute. Clear the value and set it to a valid OID like 1.2.840.113556.1.3.11 (a common class OID). Apply. Reboot normally.
Force replication check
After reboot, run repadmin /replsum to verify replication health. If error persists, demote and repromote the DC.

Alternative fixes

Method	When to use
Demote and re-add DC	If restore fails and manual edit doesn't stick
Restore whole system state	If multiple schema objects are broken
Use `dcdiag /fix`	Only for minor NTDS issues — won't fix schema corruption

Don't bother running sfc /scannow or chkdsk — they don't touch AD schema. I've watched junior guys waste hours on that.

Prevention tip

Lock the schema before any changes. On the schema master, run reg add HKLM\System\CurrentControlSet\Services\NTDS\Parameters /v Schema Allowed /t REG_DWORD /d 0 /f to block edits. Also, backup the system state (including schema) before any Exchange or hotfix install. Without a recent backup, you're gambling every time you touch the schema.

Real-world trigger: A junior admin ran an Exchange 2019 schema prep without checking the schema master was online. It half-completed, leaving a garbled governsID on one attribute. Caused this exact error on all domain controllers within 15 minutes.