The schema in an Active Directory environment provides the blueprints for all of the classes and attributes. A forest has a single instance of the schema which is located in the Schema naming context, under the forest root domain at cn=schema,cn=Configuration,dc=rootdomain,dc=rootdomainextension
.
Each class in the Active Directory environment is represented by an object of the classSchema
class and each attribute is defined by an object of the attributeSchema
class. These objects are then stored in the schema.
Class and attribute definitions are themselves objects stored in the AD schema.
![](Resources/Images/AD%20Schema%20.svg)
Every AD environment comes with a default schema containing various pre-defined classes and attributes and administrators are free to add custom ones.
Modifying the AD Schema can be graphically done with the Microsoft Management Console (MMC). Press `Win + R` and type in `mmc`.
![](Resources/Images/Launc%20MMC.png)
Next, add the `Schema` snap-in by clicking on `File -> Add/Remove Snap-in` and selecting `Active Directory Schema`.
![](Resources/Images/Add%20Schema%20Snap-In%20MMC.png)
Only the domain controller which holds the Schema Master FSMO role can make changes to the AD environment's Schema.
There is only one Schema Master allowed per *forest*.
Microsoft regularly updates the default schema with new server OS releases and expands the available default classes and attributes.
OS Release | Schema Version |
---|---|
Windows 2000 | 13 |
Windows Server 2003 | 30 |
Windows Server 2003 R2 | 31 |
Windows Server 2008 Beta Schema | 39 |
Windows Server 2008 | 44 |
Windows Server 2008 R2 | 47 |
Windows Server 2012 | 56 |
Windows Server 2012 R2 | 69 |
Windows Server 2016 | 87 |
Windows Server 2019 | 88 |
Windows Server 2022 | 88 |
One can check the version of the currently used schema with ADSI Edit. Open ADSI Edit, click on Action -> Connect To...
. Click on Select a well known Naming Context
and choose the Schema
naming context.
Next, right-click on the Schema
field with the server icon and select properties. The schema version is contained in the objectVersion
attribute:
Alternatively, one can use the following PowerShell code:
Get-ItemProperty 'AD:\CN=Schema,CN=Configuration,DC=<rootdomain>,DC=<rootdomainextension>' -Name objectVersion
You will have to run the Active Directory module for PowerShell, otherwise you will not be able to access the `AD:` drive.
![](Resources/Images/Active%20Directory%20Module%20for%20PowerShell.png)