Fix ERROR_DS_BAD_HIERARCHY_FILE (0x000020E9)

Quick answer

Stop the NTDS service, delete the corrupt hier.txt file from the %systemroot%\NTDS folder, then restart the service. If that doesn't fix it, restore the file from a backup or rebuild the AD database.

What's going on here?

This error pops up when you're trying to promote a domain controller or install Active Directory Domain Services, and Windows says the hierarchy file is garbage. The file in question is hier.txt inside C:\Windows\NTDS. It's a small file that stores the schema's class hierarchy for the NTDS database. When it gets corrupted—maybe from a bad shutdown, disk error, or a permissions change—AD can't load it, and you get 0x000020E9.

I've seen this mostly on Windows Server 2012 R2 and 2016 boxes that were forcefully powered off during a schema update. Also happened once on a Server 2019 machine after a failed disk defrag. The error text says "The hierarchy file is invalid"—and it means exactly that. The file isn't formatted correctly, or the NTDS service can't read it.

Fix steps

1. Check if the service is running. Open services.msc as administrator. Look for Active Directory Domain Services (or NTDS). Right-click and stop it if it's running. You'll see the status change to Stopped.
2. Locate the hierarchy file. Open File Explorer. Go to C:\Windows\NTDS (or wherever your AD database lives). Look for a file named hier.txt. It's usually about 10-50 KB.
3. Make a backup. Copy hier.txt to your desktop or another safe folder. This way if your fix makes things worse, you can put it back.
4. Delete the corrupt file. Right-click hier.txt and choose Delete. Windows will ask for permission—click Yes.
5. Restart the NTDS service. Go back to services.msc, right-click Active Directory Domain Services, and choose Start. After a few seconds, the status should show Running.
6. Test it. Open Event Viewer. Go to Windows Logs > System. Look for events from source NTDS General. You should see an event ID 1000 saying the service started successfully. No more 0x000020E9 errors.

What if that doesn't work?

Sometimes just deleting the file isn't enough because AD recreates it from a corrupt database. If the error comes back, you need to rebuild the hierarchy file manually.

1. Run ntdsutil. Open Command Prompt as administrator. Type ntdsutil and press Enter.
2. Activate instance. Type activate instance ntds and press Enter. You'll see a confirmation message.
3. Go to files management. Type files and press Enter. Then type info to see where the database files are. Note the path—it's usually C:\Windows\NTDS.
4. Repair the database. Type repair and press Enter. This will run a consistency check on the database and fix errors. It can take a few minutes. When it's done, type quit twice to exit.
5. Restart the server. Reboot the machine. After it comes up, check Event Viewer again to see if the error is gone.

Another option is to restore hier.txt from a System State backup. If you have a backup from before the corruption, copy the file to C:\Windows\NTDS and restart the service. That's the safest way if you're not comfortable with ntdsutil.

How to avoid this in the future

• Don't force shutdown a domain controller during schema updates. Always wait for the process to finish, even if it takes 10 minutes.
• Run regular System State backups. Use Windows Server Backup or a third-party tool. Daily backups are a good habit. This way you can restore a single file without rebuilding the whole AD.
• Check disk health. Run chkdsk C: /f during off-hours to catch file system errors before they corrupt AD files.
• Keep the NTDS folder on a separate drive. If possible, move the database and log files to a dedicated drive. This reduces risk from other software's writes.

This error is annoying but usually fixable in under 10 minutes. Start with the file delete and service restart—nine times out of ten that's all you need.