Fix 0X000020C4: Schema update failed – Must-Contain attribute missing

When this error shows up

You're in the Active Directory Schema snap-in, trying to edit a class (like user or group). You add a new attribute to the Must-Contain list. You click OK. Then you get:

Schema update failed: Attribute in the Must-Contain list does not exist.
Error 0x000020C4 (WERR_DS_NONEXISTENT_MUST_HAVE)

I've seen this most often after someone builds a custom application that extends the schema—like an Exchange or Lync deployment that didn't finish cleanly. Or when an admin tries to add a custom attribute before they've actually created it in the schema. The error doesn't leave you guessing. It tells you exactly what's wrong, but it doesn't tell you which attribute is the problem.

Root cause in plain English

Active Directory has two separate parts of the schema: attributes and classes. Attributes are the building blocks (like telephoneNumber). Classes are containers that group attributes together (like the user class). A Must-Contain list on a class means: every object of this class must have a value for each attribute in this list.

If you try to add an attribute to the Must-Contain list, but that attribute doesn't exist anywhere in the schema forest—not even as a disabled attribute—ADDS rejects the whole update. It does this because it can't enforce a rule on something that doesn't exist. Think of it like trying to require a driver's license number on a form before the DMV has issued any license numbers. The form doesn't know the field exists, so it can't make it mandatory.

How to fix it

You have two paths. The cleanest one: define the attribute first, then add it to the class. But sometimes you're stuck with a half-finished schema change from a vendor. I'll give you the fix for both scenarios.

Step 1 – Identify the missing attribute

1. Open ADSI Edit (run adsiedit.msc). Connect to the Schema naming context.
2. Expand CN=Schema,CN=Configuration,DC=yourdomain,DC=com.
3. Find the class you were editing. Right-click it, choose Properties.
4. In the Attribute Editor tab, scroll to mustContain. Double-click it.
5. You'll see a list of distinguished names (DNs) of attributes. One of them points to an attribute that doesn't exist. The DN will look like: CN=SomeAttribute,CN=Schema,CN=Configuration,...
6. Copy that DN. Then go to the Schema container and try to find that attribute by its CN. If it's not listed, that's your culprit.

Expected result: You'll see a list of DNs. The missing one won't resolve when you browse to that CN in ADSI Edit.

Step 2 – Create the missing attribute (if it should exist)

If the missing attribute is something you meant to add, create it now. Use the Schema snap-in or ADSI Edit:

1. Open Active Directory Schema snap-in. If you don't see it, register the DLL: run regsvr32 schmmgmt.dll as admin, then add the snap-in to an MMC console.
2. Right-click Attributes and choose Create Attribute.
3. Give it a name (same as the CN you found in Step 1). Set the OID (you can look up the correct OID from the previous failed attempt, or use a unique OID if you own the schema extension). Set syntax and other properties.
4. Click OK. Wait for replication if you're in a multi-DC environment.
5. Now go back to the class and add that attribute to the Must-Contain list again.

Expected result: The class update should succeed. You'll see a green checkmark and no error.

Step 3 – Remove the orphaned reference (if the attribute was a mistake)

If the attribute was never supposed to be there—maybe a vendor script left a broken DN—you need to edit the mustContain attribute directly in ADSI Edit:

1. Back in ADSI Edit, right-click the class, choose Properties.
2. Double-click mustContain. Select the DN that points to the missing attribute.
3. Click Remove. Click OK.
4. Close the property window. The class now has no reference to that attribute.

Expected result: The class properties update immediately. No error.

What to verify if it still fails

If you still get the error after these steps, check a few things:

• Replication: Did you create the attribute on the same Domain Controller you're editing the class on? AD schema changes are replicated. If you created it on one DC and are trying to edit the class on another, wait for replication (run repadmin /syncall or force it).
• Attribute is not disabled: Right-click the attribute in the Schema snap-in, go to Properties. Make sure Attribute is active is checked. Inactive attributes can't be used in Must-Contain lists.
• You have Schema Admin rights: Only members of Schema Admins can modify the schema. If you're not, the operation silently fails or gives a different error. Check your group membership.
• The OID matches: If you created a new attribute but used a different OID than what the original list expected, the DN won't match. The DN in the mustContain list must point to an existing CN in the Schema container. You can't have two attributes with different OIDs but the same name.

The 0x000020C4 error is straightforward once you know where to look. Nine times out of ten, it's a missing attribute that needs to be created or a stale reference that needs to be removed. Don't beat your head against the wall—ADSI Edit is your friend here.