Some programs that integrate with Active Directory will make the appropriate changes to the schema for you. For example, if you install Microsoft Exchange, the setup programs updates the schema and the change is replicated to all the DCs so they know about the new Exchange server. It’s rare that you would have to manually make changes to the schema. Only individuals who are Active Directory experts and are very familiar with Active Directory schema are qualified to make changes to the schema. You must be a member of the Active Directory Schema Admins group to make changes to the schema. Manually making changes to the schema is like doing a brain surgery on the Active Directory. One serious mistake can potentially burn down your entire forest. Here are some important concepts that you mind helpful when working with Active Directory schema.<\/p>\n
When you install Microsoft\u00a0Active, the setup program creates the schema which includes objects and their definitions. You can create new object definitions in schema, and then create objects based on those definitions, but you cannot delete the Active Directory schema objects or the object definitions. Yes, that’s right. You can only add object definitions to schema, but you cannot delete them. There is a reason for that, but that discussion is beyond the scope of this article. What if you make a mistake when creating object definitions? That’s too bad. I told you modifying schema manually is like doing a brain surgery. The best you can do is deactivate<\/em> the object definition so it can’t be used to create new\u00a0Active Directory objects. Microsoft uses the term defunct<\/em> for objects whose definitions have been deactivated.<\/p>\n Another thing to keep in mind is that you can only deactivate the schema objects that were added to the default\u00a0Active Directory schema. You cannot, however, deactivate the original schema objects that are part of the default schema because it may negatively impact the Active Directory behavior. Let’s summarize these important points.<\/p>\n You can use the Active Directory Schema snap-in to manage Active Directory schema. Because schema is not something that Microsoft wants us to play around, Microsoft decided not to add the Schema management console in the Windows Administrative Tools section on the Windows server. That was a smart move to prevent Active Directory administrators from poking around in the console and accidentally making harmful changes to the Active Directory schema.<\/p>\n If you start a new MMC and look for Active Directory Schema snap-in, you won’t find it because it doesn’t exist. However, you can first register the Active Directory Schema snap-in. This step makes the Active Directory Schema snap-in available to the MMC so you can add it and manage the schema.<\/p>\n Here’s how you can register and then add the Active Directory Schema snap-in to the MMC console.<\/p>\n There are several tools available to modify the schema. Some are included in Windows server, others are third-party tools. Of course, you can also use PowerShell to modify the schema. No matter which tool you use, you can only modify the schema on the server that has the Schema Master role. This is one of the five Operations Master roles assigned to a server. These roles are referred to as FSMO roles. By default, the first domain controller in the forest hosts all five of these FSMO roles. However, you can move these roles to other servers if necessary.<\/p>\n Only one server in the enterprise performs the Schema Master role. This role allows modifications to the schema.\u00a0The\u00a0Active Directory Schema snap-in can be used to move the Schema Master role from one domain controller to another. This option is available when you right click the Active Directory Schema folder.<\/p>\n\n
Registering the AD Schema MMC Snap-In<\/strong><\/h4>\n
![\"Adding](\"https:\/\/www.zubairalexander.com\/blog\/wp-content\/uploads\/2018\/08\/AD-Schema-SnapIn.png\")
<\/a><\/p>\n\n
\nregsvr32.exe schmmgmt.dll<\/strong>
\n<\/a><\/li>\n<\/a><\/li>\nSchema Master Role<\/strong><\/h4>\n
\n\n
\n Thanks for reading my article. If you are interested in IT training & consulting services, please reach out to me. Visit ZubairAlexander.com<\/a> for information on my professional background.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n