Now when we are done with all the ads components overview, let's take a closer look at each of these
components.
For example, schema.
What is the Active Directory schema?
A schema defines the rules and syntax of the Active Directory database and provides the blueprint for
the objects within it.
So the Active Directory schema is a component that defines all the object classes and attributes that
Active Directory uses to store data.
All domains in a forest contain a copy of the schema that applies to that forest.
Any changes in the schema replicates to every domain controller in the forest.
From the schema master, which is typically the first domain controller in the forest, adds towards
and retrieves information from a wide variety of applications and services.
It does this in part by standardizing how the Active Directory stores data, by standardizing data storage.
Active Directory can retrieve, update and replicate data while helping to maintain the data integrity.
Now let me demonstrate how schema looks like.
First off, to add schema, snap in.
In MSI console, you have to perform several steps because by default the Active Directory schema MSI
snapping is not registered on domain controllers or machines with the remote server administration tools.
So to use the snap pin for the first time on a new machine, you'll need to register the DLL to do this.
Follow these steps.
You have to open an elevated command prompt by typing cmd, run as administrator and then run the following
command.
Reg SVR 32.
Schema Management Dot DLL Only after this you have to open MSI console and in the MSI console go to
file, add, remove snap and add Active Directory schema snip in.
And after this you can expand Active Directory schema on your computer.
As you can see, in my case, it's Active Directory schema for a datum dot com domain.
We can expand it and then we can expand classes container and take a look at attributes by clicking
on attributes container.
So as you can see, we've got objects here, lots of objects and you have to know that Active Directory
uses these objects as units of storage.
The schema defines all object types.
Each time the Active Directory handles data, the directory queries the schema for an appropriate object
definition.
And based on the object definition in the schema, the directory creates the object and stores the data.
Object definitions specify both the type of data that the object can store and the syntax of the data.
You can create only objects that the schema defines because objects store data in a rigidly defined
format, Active Directory can store, retrieve and validate the data that it manages, regardless of
which application supplies it.
Now let's talk about relationships among objects, rules, attributes and classes.
In Active Directory, the schema defines the following objects that store data in the directory or rules
that define the structure of the objects and the structure and content of the directory itself.
ADA Schema objects consist of attributes which are grouped together in classes.
Each class has rules that define which attributes are mandatory and which are optional.
For example, the user class.
Let me scroll down in classes container until I find user class.
So this class consists of more than 400 possible attributes, including CM which.
The common name, attribute, given name, display name, object seed, which is security identifier
and manager of these attributes, the scene and object attributes are mandatory.
The scene attribute is a single value unicode string that is form of one through 64 characters lone
and that replicates to the global catalog.
Now let me sort by name and find.
As you can see in type colon, they've got mandatory.
Of course, you can sort here by type to see all the mandatory parameters by clicking up here on the
column name type.
And of course, you can read the description column.
For example, this one object said it is mandatory and the description is object seed, which is security
identifier.
Now who can change this schema?
Only members of schema admins group can modify the added schema.
You cannot remove anything from the added schema.
You can only extend the Active Directory schema by using its schema extensions or by modifying the attributes
of existing objects.
For example, when you are preparing to install Microsoft Exchange Server 2016, you must apply the
exchange server Active Directory Schema changes.
These changes add or modify hundreds of classes and attributes.
You should change the schema only when necessary because the schema controls the storage of information.
Any changes made to the schema effect?
Every domain controller before you change the schema.
You should review the changes and implement them only after you have performed testing.
This will help ensure that the changes will not adversely affect the rest of the forest or any application
that use ads.
The Schema Master is one of the operations master roles hosted on a single domain controller in ads.
We'll cover in more detail the topic operations master roles a bit later.
And now back to Schema Master.
Because it's a single master, you must use the Active Directory schema snapping to make changes to
the schema by targeting the domain controller that holds the schema master.
To target the schema master in a separate forest, you'll need to target the appropriate forest from
within the snipe in.