Stretch Active Directory's schema to fit your needs

Active Directory is at the heart of your Windows 2000-based network. It contains all of the objects that represent network resources, all the people that can access those resources, and the way they all relate to one another. Within each object is a set of properties that contains information about the object.

For example, the user object includes properties that describe the user’s name, address, and telephone number, as well as what rights the user has on the network. But, what do you do if you want to include additional information, such as the hire date, that doesn’t have a predefined property inside of an object?

Don’t worry. Microsoft has given you the ability to extend Active Directory’s schema to include these new properties. I’ll show you how it’s done.

What's Active Directory schema?
Think of Active Directory’s schema as the recipe book for Active Directory. It describes all of the objects, object classes, and properties within Active Directory. It controls what types of objects can exist in Active Directory and what properties can exist within those objects.

Active Directory’s schema covers your network’s entire forest structure. All Active Directory trees, domains, and domain controllers within an Active Directory forest share the same schema.

Active Directory comes with many preexisting object classes and properties. For example, within the user object, you’ll find fields that describe the user’s name, location, group membership, and security rights.

All new user objects that you create are built off of a base user-object class template that the schema defines. This gives the same basic attributes to each occurrence of the user object throughout the schema.

If you look through a basic object’s properties, such as the user object's, you’ll see dozens of different attributes that you can set. Chances are, you don’t even use most of them. Occasionally, however, there may be an attribute you want to store but can’t, since you don’t have a location to put it in. That’s when you’ll need to change the schema to add the additional attributes

---

Danger, Will Robinson!
Changes made when modifying the schema cannot be undone. Be very careful when making schema modifications. It’s all too easy to severely damage your Active Directory tree. The schema can only be edited by the domain controller (DC) that has the flexible single master operation (FSMO) role of Schema Master.

---

The only tools you'll ever need (for schema editing, that is)
Microsoft provides two tools for making modifications to the Active Directory schema: Active Directory Service Interfaces (ADSI) Edit and the Active Directory Schema Editor.

The ADSI Edit tool allows direct editing of the schema. Using it requires an extensive knowledge of Active Directory, Lightweight Directory Access Protocol (LDAP), and ADSI. It’s very difficult to use and understand, and it isn’t a good choice for beginners or even those with midlevel skills, especially if you only want to make a minor schema adjustment. This tool could cause major nightmares within your Active Directory structure if not used with great care.

The Active Directory Schema Editor is supplied along with Windows 2000 as a Microsoft Management Console (MMC) snap-in. Windows 2000’s Setup program doesn’t install the Active Directory Schema Editor in its default routine. You must both register the snap-in and create an MMC before you can use it. Since the schema is such a sensitive area within Active Directory, I recommend setting up a new MMC console for schema modification and allowing only highly trusted and knowledgeable network personnel to have access to this console.

To register the Active Directory Schema Editor, open a command prompt, type regsvr32 schmmgmt.dll, and press [Enter]. When you do, you’ll see a RegSrv32 dialog box appear displaying the message, "DllRegisterServer in schmmgmt.dll succeeded.” Once the schmmgmt.dll is registered for use on the server, you can use it as an MMC snap-in.

To install the Active Directory Editor snap-in, click Start | Run and enter MMC /a in the Run dialog box. This opens a blank MMC console in author mode. Maximize the Console Root window to make the MMC easier to view and work with. Next, select Add/Remove Snap-In from the Console menu. When the Add/Remove Snap-In window appears, click Add. Doing so will display the Add Standalone Snap-In window, which contains a list of available snap-ins that you can use to create your MMC.

Scroll through the list of snap-ins until you see Active Directory Schema. Select it and then click Add. Click Close to close the Add Standalone Snap-In dialog box and then click OK to close the Add/Remove Snap-In dialog box. You’ll see the Active Directory Schema MMC appear, as shown in Figure A.


To save yourself the hassle of having to create a custom MMC every time you want to use the Active Directory Schema Editor, you should save the MMC before going any further. Click Save from the Console menu. When the Save As window appears, type Active Directory Schema Editor in the File Name field. Accept the default location, which will cause the Schema Editor to be saved in the Administrative Tools folder. Next time you want to start the Schema Editor, click Start | Programs | Administrative Tools | Active Directory Schema Editor.