---
description: Definition of the AD Schema
---

# AD Schema

## <mark style="background-color:blue;">Definition of the AD Schema</mark>

> 1. **The Active Directory (AD) Schema is a critical component of Microsoft's Active Directory service, serving as the blueprint that defines the structure, content, and rules for all objects and their attributes within an AD forest.**
> 2. **The AD Schema is a formal, hierarchical set of metadata definitions that governs the types of objects that can be created and stored in Active Directory, as well as the attributes (properties) these objects can have. It acts as a centralized framework that ensures consistency, integrity, and interoperability across all domain controllers in an AD forest.**
> 3. _<mark style="color:blue;">**The schema defines "what" can exist in the directory (users, computers, groups) and "how" these entities are structured ( what data fields they include, such as names or email addresses).**</mark>_

## **Key Characteristics**

1.  <mark style="background-color:blue;">**Centralized and Replicated:**</mark> The schema is stored in a dedicated partition called the **schema partition** (_<mark style="color:blue;">**`CN=Schema,CN=Configuration,DC=mycorp,DC=com`**</mark>_) and is replicated across all domain controllers in the forest to maintain a consistent directory structure.


2.  <mark style="background-color:blue;">**Extensible:**</mark> Administrators can add custom object classes and attributes to support specific organizational or application needs, such as integrating with third-party software.


3.  <mark style="background-color:blue;">**Immutable and Forest-Wide:**</mark> Schema changes are permanent (objects can only be deactivated, not deleted) and apply to the entire forest, making modifications high-impact and requiring careful planning.


4. <mark style="background-color:blue;">**Controlled Access:**</mark> Only members of the **Schema Admins** group can modify the schema, and changes are processed by the **Schema Master**, a single domain controller holding the Flexible Single Master Operation (FSMO) role for schema updates.

## Components of the AD Schema

> <mark style="background-color:blue;">The schema is composed of two primary elements:</mark> <mark style="background-color:blue;"></mark><mark style="background-color:blue;">**classes**</mark> <mark style="background-color:blue;"></mark><mark style="background-color:blue;">and</mark> <mark style="background-color:blue;"></mark><mark style="background-color:blue;">**attributes**</mark><mark style="background-color:blue;">, which are defined as objects within the schema partition. These components work together to define the structure and content of the directory.</mark>

**1. Classes**

> <mark style="background-color:blue;">Classes define the types of objects that can be created in AD. Each object in the directory is an instance of a class, and classes are categorized into three types:</mark>

* <mark style="background-color:blue;">**Structural Classes:**</mark> These are concrete objects that can be instantiated. Examples include:
  * <mark style="color:blue;">**User:**</mark> Represents a user account (an employee named Alice Johnson).
    * <mark style="background-color:blue;">**Attributes**</mark><mark style="background-color:blue;">:</mark> _<mark style="color:blue;">**`cn (common name)`**</mark>_ _<mark style="color:blue;">**`userPrincipalName`**</mark>_,  _<mark style="color:blue;">**`givenName`**</mark>_, _<mark style="color:blue;">**`sn (surname`**</mark>_).
    * **Example&#x20;**_<mark style="color:blue;">**`DN: CN=Alice Johnson,OU=Employees,DC=mycorp,DC=com.`**</mark>_
  * <mark style="color:blue;">**Group:**</mark> Represents a collection of users or computers for access control or distribution.
    * **Attributes**: _<mark style="color:blue;">**`cn, member (multivalue, listing members),`**</mark>_ _<mark style="color:blue;">**`groupType.`**</mark>_
    * **Example&#x20;**_<mark style="color:blue;">**`DN: CN=SalesTeam,OU=Groups,DC=mycorp,DC=com.`**</mark>_
  * <mark style="color:blue;">**Computer:**</mark> Represents a device joined to the domain.
    * **Attributes**: _<mark style="color:blue;">**`cn`**</mark>_, _<mark style="color:blue;">**`operatingSystem`**</mark>_, _<mark style="color:blue;">**`servicePrincipalName`**</mark>_.
    * **Example&#x20;**_<mark style="color:blue;">**`DN: CN=WS001,OU=Workstations,DC=mycorp,DC=com.`**</mark>_
  *   <mark style="color:blue;">**OrganizationalUnit (OU)**</mark>: A container for organizing objects.

      * **Attributes**: _<mark style="color:blue;">**`ou, description.`**</mark>_
      * **Example&#x20;**_<mark style="color:blue;">**`DN: OU=Marketing,DC=mycorp,DC=com.`**</mark>_&#x20;


*   <mark style="color:blue;background-color:blue;">**Abstract Classes:**</mark> These cannot be instantiated but serve as templates for inheritance. Example:

    * **Top**: The root class from which all structural classes inherit, providing common attributes like _<mark style="color:blue;">**`objectClass, objectCategory, and name.`**</mark>_&#x20;


*   <mark style="color:blue;background-color:blue;">**Auxiliary Classes**</mark><mark style="color:blue;background-color:blue;">:</mark> These add attributes to structural classes without creating new object types. Example:

    * <mark style="color:blue;">**securityPrincipal:**</mark> Adds security-related attributes (_<mark style="color:blue;">**`objectSid`**</mark>_, _<mark style="color:blue;">**`sAMAccountName`**</mark>_) to classes like user and computer.
    * <mark style="color:blue;">**mailRecipient:**</mark> Used by Exchange to add email-related attributes (_<mark style="color:blue;">**`mail`**</mark>_, _<mark style="color:blue;">**`proxyAddresses`**</mark>_).



Each class is represented by a _<mark style="color:blue;">**`classSchema`**</mark>_ object in the schema partition, with properties such as:

* <mark style="color:blue;background-color:blue;">**governsID:**</mark> The OID uniquely identifying the class (1.2.840.113556.1.5.9 for user).
* <mark style="color:blue;background-color:blue;">**lDAPDisplayName:**</mark> The name used by LDAP clients (user).
* <mark style="color:blue;background-color:blue;">**subClassOf:**</mark> The parent class for inheritance (user inherits from organizationalPerson).
* <mark style="color:blue;background-color:blue;">**mustContain:**</mark> Mandatory attributes (cn for all classes).
* <mark style="color:blue;background-color:blue;">**mayContain:**</mark> Optional attributes (_<mark style="color:blue;">**`telephoneNumber`**</mark>_, _<mark style="color:blue;">**`description`**</mark>_).
* <mark style="color:blue;background-color:blue;">**schemaIDGUID**</mark><mark style="color:blue;background-color:blue;">:</mark> A globally unique identifier (GUID) for the class.
