Active Directory Schema

Active Directory® Schema is a Microsoft Management Console (MMC) snap-in that you can use to view and manage the Active Directory Domain Services (AD DS) schema.

Note

You can also use the Active Directory Schema snap-in to view and manage Active Directory Lightweight Directory Services (AD LDS) schema objects.

Schema definitions

The schema contains formal definitions of every object class that can be created in an Active Directory forest. The schema also contains formal definitions of every attribute that can or must exist in an Active Directory object.

Schema containers

The Active Directory Schema snap-in includes two containers: the Classes container and the Attributes container. These containers store the class and attribute definitions. These definitions take the form of classSchema objects, which you can view in the Classes container, and attributeSchema objects, which you can view in the Attributes container.

Schema changes

Making changes to the AD DS schema is advisable only rarely. Errors in schema changes can result in data loss and corruption. For this reason, before you attempt any manipulation of schema objects, be sure that you understand the effects of the change and that you have deployed the change and observed its effects in a test forest.

Before making any schema changes, read the Active Directory Schema Technical Reference (http://go.microsoft.com/fwlink/?LinkID=65961). For information about how to make schema changes, see Active Directory Schema (http://go.microsoft.com/fwlink/?LinkId=80809).

  • Overview of the Active Directory Schema Snap-in

  • Installing, Securing, and Viewing the Schema

  • Troubleshooting Active Directory Schema

  • Resources for Active Directory Schema

  • User Interface: Active Directory Schema


Overview of the Active Directory Schema Snap-in

You can use the Active Directory Schema Microsoft Management Console (MMC) snap-in to view and manage Active Directory Domain Services (AD DS) schema objects. The Active Directory Schema snap-in has more strict installation and use requirements than other administrative tools. To make changes in the Active Directory Schema snap-in, you must be a member of the Schema Admins security group in the forest root domain of your Active Directory forest. By default, the Administrator account for the forest root domain is the only member of the Schema Admins group.

With the Active Directory Schema snap-in, you can view class and object definitions, provide administrative access to the schema, and modify schema classes and attributes. However, modifying the schema is an advanced and complex operation that is best handled by experienced programmers and administrators. For this reason, information about modifying the schema is located primarily in programming documentation. For information about modifying the schema, see Active Directory Schema (http://go.microsoft.com/fwlink/?LinkId=80809).

Note

You can also use the Active Directory Schema snap-in to view and manage Active Directory Lightweight Directory Services (AD LDS) schema objects.

Additional references

Installing, Securing, and Viewing the Schema


Installing, Securing, and Viewing the Schema

In most Active Directory forests, you do not have to manage schema objects or their properties in any way other than to provide security to ensure that only authorized administrators have access to the schema. The default access to schema objects and properties is limited to the Administrator account in the forest root domain. However, you may occasionally want to provide schema permissions to other administrators if, for example, an application developer needs to modify a schema object or troubleshoot a schema compatibility problem for an application.

You also may need to install the Active Directory Schema snap-in on other domain controllers. You can use the Active Directory Schema snap-in to view schema class and attribute objects and properties.

Installing the Active Directory Schema snap-in

Because schema management is not a typical administrative objective and because schema changes have potentially harmful forest-wide consequences, the Active Directory Schema snap-in is not installed by default when you add the Active Directory Domain Services (AD DS) role. Before you can add the Active Directory Schema snap-in to Microsoft Management Console (MMC), you must register Schmmgmt.dll in AD DS. The requirement for this preliminary step discourages improper use of the tool. After you register Schmmgmt.dll, the Active Directory Schema snap-in is available to be added to MMC.

Install the Active Directory Schema Snap-In

Providing administrative access to the schema

Members of the Schema Admins group have permission to perform all modifications to the schema except Delete All Child Objects. By default, the only member of the Schema Admins group is the Administrator account in the forest root domain.

Granting permissions to an administrator

You can use the Active Directory Users and Computers snap-in to add another user to the Schema Admins group. Only one additional user should be added to the group at a time. As a best practice, if you determine that a change must be made to the schema, add an administrative user to the Schema Admins group to allow the change. After the change is complete, remove the administrative user from the group.

Specifying individual permissions

You can also provide permissions for specific schema management tasks without allowing permissions to make all changes. Use the Permissions option to grant specific access to a user or group. Again, when the access is no longer needed, remove the permissions for the user or group.

Apply Active Directory Schema Administrative Permissions

Viewing class and attribute definitions

The Active Directory Schema snap-in provides a view of the classSchema and attributeSchema objects.

View Schema Class and Attribute Definitions


Install the Active Directory Schema Snap-In

You can use this procedure to first register the dynamic-link library (DLL) that is required for the Active Directory Schema snap-in. You can then add the snap-in to Microsoft Management Console (MMC).

Membership in Domain Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To install the Active Directory Schema snap-in

  1. Open a command prompt, type the following command, and then press ENTER:

    regsvr32 schmmgmt.dll

  2. Click Start, click Run, type mmc, and then click OK.

  3. On the File menu, click Add/Remove Snap-in.

  4. Under Available snap-ins, click Active Directory Schema, click Add, and then click OK.

  5. To save this console, on the File menu, click Save.

  6. In the Save As dialog box, do one of the following:

    • To place the snap-in on the Administrative Tools menu, in File name, type a name for the snap-in, and then click Save.

    • To save the snap-in in a location other than the Administrative Tools folder, in Save in, navigate to a location for the snap-in. In File name, type a name for the snap-in, and then click Save.
Caution

Modifying the schema is an advanced operation that is best performed by experienced programmers and system administrators. For detailed information about modifying the schema, see Active Directory Schema in (http://go.microsoft.com/fwlink/?LinkId=80809).

Additional considerations

  • To perform the Schmmgmt.dll registration portion of this procedure, you must be a member of the Domain Admins group in the domain or the Enterprise Admins group in the forest, or you must have been delegated the appropriate authority. Adding the Active Directory Schema snap-in to MMC requires only Domain Users group membership. However, making changes to the schema requires membership in the Schema Admins group.

  • The Windows Server 2008 Administration Tools Pack cannot be installed on computers running Windows XP Professional or Windows Server 2003.

Additional references

  • Installing, Securing, and Viewing the Schema


Apply Active Directory Schema Administrative Permissions

You can set permissions for performing tasks in the Active Directory Schema snap-in.

Membership in Schema Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To apply permissions to perform a schema task

  1. Open the Active Directory Schema snap-in.

  2. In the console tree, click Active Directory Schema to connect to the domain.

  3. In the console tree, right-click Active Directory Schema, and then click Permissions.

  4. In Group or user names, select a user or group, or click Add to add a user or group.

  5. In Permissions for <user_name>, select or clear the permission that you want to grant or deny, respectively, and then click OK.

Additional considerations

  • Performing this task requires you to have schema administrator credentials, which are assigned to only the Schema Admins group. By default, only the Administrator account in the forest root domain is a member of the Schema Admins group. You can set permissions for different administrators to manage schema operations, but it is best to limit the number of schema administrators to a single highly trusted administrator in the forest.

  • If the Active Directory Schema snap-in is not installed, see Install the Active Directory Schema Snap-In.

Additional references

Installing, Securing, and Viewing the Schema


View Schema Class and Attribute Definitions

You can view schema definitions in the properties of the attributeSchema and classSchema objects in the Active Directory Schema snap-in in Microsoft Management Console (MMC).

Membership in Domain Users, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To view a schema class or attribute definition

  1. Open the Active Directory Schema snap-in.

  2. In the console tree, double-click Active Directory Schema.

  3. Do one of the following:

    • To view a class definition, in the console tree, click and expand Classes. Right-click the class for which you want to view a definition, and then click Properties.

    • To view an attribute definition, in the console tree, click Attributes. In the details pane, right-click the attribute for which you want to view a definition, and then click Properties.

Additional considerations

  • Performing this task does not require you to have administrative credentials. Therefore, as a security best practice, consider performing this task as a user without administrative credentials.

  • If the Active Directory Schema snap-in is not installed, see Install the Active Directory Schema Snap-In.

Additional references

Installing, Securing, and Viewing the Schema


Troubleshooting Active Directory Schema

  • I am unable to add the Active Directory Schema snap-in to Microsoft Management Console (MMC).

  • I am unable to find the Active Directory Schema snap-in.

I am unable to add the Active Directory Schema snap-in to Microsoft Management Console (MMC).
  • Cause: Schmmgmt.dll has not been registered.

  • Solution: Open a command prompt, type regsvr32 schmmgmt.dll, and then press ENTER.

I am unable to find the Active Directory Schema snap-in.
  • Cause: You saved the MMC snap-in, but you do not know where it is saved.

  • Solution: Open MMC (click Start, click Run, type mmc, and then click OK), and then click File. The menu shows the last four locations where you saved a snap-in. Check to see if Active Directory Schema or Schmmgmt.msc is on the list, and then follow the path to the file. When you locate the .msc file, drag it to the Start menu to create a shortcut to the snap-in.


Resources for Active Directory Schema

For more information about the Active Directory Schema snap-in and its manageable objects, see the following resources:

  • For information about the Active Directory schema, see the Active Directory Schema Technical Reference (http://go.microsoft.com/fwlink/?LinkId=90646).

  • For information about modifying the Active Directory schema, see Active Directory Schema (http://go.microsoft.com/fwlink/?LinkId=80809).


User Interface: Active Directory Schema

  • <ClassName> Properties - General Tab

  • <ClassName> Properties - Relationship Tab

  • <ClassName> Properties - Attributes Tab

  • <AttributeName> Properties Sheet

  • Create New Schema Class Dialog Box - Layout 1

  • Create New Schema Class Dialog Box - Layout 2

  • Create New Attribute Dialog Box

  • Change Schema Master Dialog Box


<ClassName> Properties - General Tab

Item Details

Common Name

The relative distinguished of the class instance.

X.500 OID

The object identifier (also known as OID), which is issued by the International Standards Organization (ISO) and guaranteed to be unique across all networks worldwide. Object identifiers ensure that classes or attributes that are defined by different entities do not conflict when various directory services, such as Active Directory Domain Services (AD DS), are brought together into a global directory.

Class Type

The selected class can be one of three types:

  • Structural: The class can be instantiated in the directory.

  • Abstract: The class provides a basic definition of a class that can be used to form structural classes.

  • Auxiliary: The class can be used to extend the definition of a class that inherits from it, but it cannot be used to form a class by itself.

Category

The name of this class that is used by the Lightweight Directory Access Protocol (LDAP) agent for AD DS. LDAP clients must use this name to access objects of this class.

Change

Click to change the default objectCategory of the selected class. This button is disabled for objects that are marked as “base schema”.

Show objects of this class while browsing

Select to control the defaultHidingValue attribute on the class. This attribute controls the default value of the showInAdvancedViewOnly attribute on newly created objects of the class.

Class is active

Click to deactivate the class if it is active.

You can use deactivation to recover the class; deletion is permanent. When a class is deactivated, you can no longer create objects that are instances of that class. A deactivated class still exists in the directory. Therefore, you cannot create new classes with the same name.

If this check box is unavailable, the class is in the base schema and AD DS requires that it remain active. The class cannot be deactivated.


<ClassName> Properties - Relationship Tab

Item | Details
Parent Class | The class of which the current class is a subclass. The current class inherits mandatory and optional attributes from the specified parent class.
Auxiliary Classes | The auxiliary classes or subclasses of the parent class. A class can have one parent and many auxiliary classes. Auxiliary class attributes are fully inheritable by the subclasses.
Add Class | Click to add new auxiliary classes for this class.
Remove | Click to remove auxiliary classes for this class.
Possible Superior | The possible tree structures for the directory are specified by the classes that can be the parent of a given class.
Add Superior | Click to add a new superior class for the selected class.
Remove | Click to remove a superior class from the selected class.


<ClassName> Properties - Attributes Tab

Item | Details
Mandatory | Displays a list of attributes that cannot be removed from the selected class.
Optional | Displays a list of attributes that can be added and removed from the selected class.
Add | Click to add a new optional attribute to the selected class.
Remove | Click to remove an optional attribute from the selected class.


<AttributeName> Properties Sheet

Tab Details

Common Name

The relative distinguished name of the class instance.

X.500 OID

The object identifier (also known as OID), which is issued by the International Standards Organization (ISO) and guaranteed to be unique across all networks worldwide. Object identifiers ensure that classes or attributes that are defined by different entities do not conflict when various directory services, such as Active Directory Domain Services (AD DS), are brought together into a global directory.

Syntax and Range

  • Syntax: A data type that can be used for a particular attribute, such as an integer, a string, or a date. Every attribute of every object is associated with exactly one syntax.

  • Minimum: Valid characters are 0 through 9. The minimum acceptable value is determined by the attribute's syntax. Integer, Large Integer, and Enumeration syntaxes accept negative numbers. For these syntaxes, the smallest value that can be entered is -2,147,483,648. For all other syntaxes, the smallest value that can be entered is 0 (zero).

  • Maximum: Valid characters are 0 through 9. The maximum acceptable value is determined by the attribute's syntax. If minimum and maximum values are defined, the maximum value must be greater than or equal to the minimum value.

  • This attribute is single-valued: In Lightweight Directory Access Protocol (LDAP), attributes can be single-valued (they can be assigned only one value ) or multivalued (they can be assigned many values). An example of a single-valued attribute is "manager", because a user can have only one manager. An example of a multivalued attribute is "member", because a group can have many members.

Attribute is active

Clear the check box to deactivate the attribute if it is active. You can use deactivation to recover the attribute; deletion is permanent.

AD DS does not permit you to delete classes or attributes. When an attribute is deactivated, you cannot use it in definitions of new classes, and you cannot add it to existing class definitions.

Index this attribute

Indexing an attribute increases search efficiency, but it also adds to storage requirements. Index only the attributes that are most likely to be searched.

Ambiguous Name Resolution (ANR)

Adds the attribute to the set of attributes that can be searched with an ANR filter of the form (ANR=string). When the (ANR=string) filter is encountered by AD DS, the filter is expanded to include a search of every attribute in the ANR set. For example, an ANR search is implemented when you use the Check Names option in Microsoft Outlook that searches against a Microsoft Exchange mail server. Because physicalDeliveryOfficeName is in the default ANR attribute set, you can type the building number and room number as it appears in the attribute value into the To line of a mail message and then click Check Names. The Address Book responds with the user name of any account that contains that value in the physicalDeliveryOfficeName attribute of a user object. This option is available for string-valued attributes only.

Replicate this attribute to the Global Catalog

Adds the attribute to the set of attributes, called the partial attribute set (PAS), that is replicated to all domain controllers in the forest. All objects are replicated to the global catalog, but only the attributes that are included in the PAS are replicated. PAS attributes should be those attributes that are most likely to be used to search for the object.

Attribute is copied when duplicating a user

Applies only to attributes that occur in the user class. When a user object is copied to create a new user instance, these attributes are included.

Index this attribute for containerized searches

Allows the defining of a search for an attribute that is located in a specific container.


Create New Schema Class Dialog Box - Layout 1

Item Details

Common Name

The name that represents an object and that is used to perform searches.

LDAP Display Name

The name that is used by Lightweight Directory Access Protocol (LDAP) clients, such as the Active Directory Service Interfaces (ADSI) LDAP provider, to read and write the attribute using the LDAP protocol.

Unique X500 Object ID

The value for the governsID attribute in a classSchema object. Object identifier notation is a dotted string of nonnegative numbers, for example, 1.2.840.113556.1.5.4.

Inheritance and Type

Parent Class: A new object is defined as a subclass of its parent object. A subclass inherits structure and content rules from the parent class. The parent object becomes a superclass of the new object.

Class Type: One of the following:

  • Structural: The only classes that can have instances in the directory.

  • Abstract: Templates that are used to derive new structural classes. No object can belong only to an abstract class; each object of an abstract class also belongs to some structural subclass of that class.

  • Auxiliary: Contains a list of attributes. Adding an auxiliary class to the definition of a structural class or an abstract class adds the auxiliary class attributes to the definition.


Create New Schema Class Dialog Box - Layout 2

Item | Details
Mandatory | Lists object attributes for which a value must be specified. If a value is not specified for a mandatory attribute, the attribute receives a default value or the object is not created until a value for the attribute is specified.
Add | Click to add mandatory attributes to the class that you are creating.
Remove | Click to remove mandatory attributes from the class that you are creating.
Optional | Lists object attributes that do not require a value.
Add | Click to add optional attributes to the class that you are creating.
Remove | Click to remove optional attributes from the class that you are creating.


Create New Attribute Dialog Box

Item Details

Common Name

The name that represents an object and that is used to perform searches.

LDAP Display Name

The name that will be used by Lightweight Directory Access Protocol (LDAP) clients, such as the Active Directory Service Interfaces (ADSI) LDAP provider, to read and write the attribute using the LDAP protocol.

Unique X.500 Object ID

The object identifier (also known as OID) that is the value for the attributeID attribute of the attributeSchema object. You must apply to either the International Standards Organization (ISO) or Microsoft for a unique X.500 object identifier.

Syntax and Range

  • Syntax: Specifies a list of available syntaxes, that is, data types that can be assigned to a new attribute, such as integer, string, or date. Every attribute of every object is associated with exactly one syntax.

  • Minimum: Provides space for you to specify the minimum value for the new attribute. Valid characters are 0 through 9. The minimum acceptable value is determined by the attribute's syntax. Integer, Large Integer, and Enumeration syntaxes accept negative numbers. For these syntaxes, the smallest value that can be entered is -2,147,483,648. For all other syntaxes, the smallest value that can be entered is 0 (zero).

  • Maximum: Provides space for you to specify the maximum value for the new attribute. Valid characters are 0 through 9. The maximum acceptable value is determined by the attribute's syntax. If minimum and maximum values are defined, the maximum value must be greater than or equal to to the minimum value.

Multi-valued

Click if the new attribute is to be multivalued. In LDAP, attributes can be single-valued (that is, they can be assigned one value only) or multivalued (they can be assigned many values). An example of a single-valued attribute is "manager," because a user can only have one manager. An example of a multivalued attribute is "member," because a group can have many members.


Change Schema Master Dialog Box

Item | Details
Current schema master (online) | If the schema master is not online, this item states "Current schema master (offline)," and the value is ERROR. If you change the holder of the schema operations master role (also known as flexible single master operations or FSMO) while the schema master is offline, you must follow the directions for seizing the schema master role, which is different from transferring the role. Seizing the schema master role is a serious operation that should be attempted only if you cannot transfer the role. Before you seize the schema master role, read about the implications of this action in the Operations Masters Technical Reference (http://go.microsoft.com/fwlink/?LinkId=80873). Then, follow the instructions in Seize the operations master role (http://go.microsoft.com/fwlink/?LinkId=80874).
Targeted schema FSMO holder | The domain controller in this box must be different from the current schema master. If this domain controller name is the same as the name in Current schema master (online), you must use the Change Active Directory Domain Controller command to change the snap-in focus to the domain controller that you want to become the schema master.
Change | Click to transfer from the current schema master to the target domain controller.