Diving into the AD Schema

Identify Yourself
Every AD class and attribute must be unique, so you must assign a unique OID to each class and attribute definition. OIDs are represented as dotted decimal strings, similar to IP addresses. (Table 4, page 58, shows the OIDs for several object classes.) A classSchema object's OID resides in its governsID attribute; an attributeSchema object's OID resides in its attributeID attribute.

The International Organization for Standardization (ISO) Name Registration Authority issues these identifiers; OIDs aren't Microsoft specific. (For information about the ISO Name Registration Authority and OIDs, visit http://web.ansi.org/public/services/reg_org.html or http://www.iso.ch/members/index.html.)

OID numbering uses a tree structure. Well-defined authorities in a naming tree can allocate branches, or arcs, of that tree to subauthorities, which can then allocate subbranches to other subauthorities. Table 5 shows the OID tree structure for the builtinDomain object class in the AD schema. (Note that as Table 4 shows, the organizationalUnit class doesn't use the Microsoft base OID. Another entity owns the organizationalUnit OID definition.) A company that wants to add a new schema attribute can apply to the ISO Name Registration Authority to register an OID or can use the Microsoft Windows 2000 Server Resource Kit's oidgen.exe tool to create a new OID below the Microsoft arc.

Don't confuse OIDs with globally unique IDs (GUIDs). An OID uniquely identifies a class; a GUID uniquely identifies an object instance. For example, the user class has the OID 1.2.840.113556.1.5.9; every User object that you create from this class has a unique GUID but comes from the same class (i.e., the class that uses the OID 1.2.840.113556.1.5.9).

The Object Category
Win2K ships with a base schema that provides all the classSchema objects and attributeSchema objects that AD needs to deliver basic features and structure. These objects are part of the base Directory Information Tree (DIT) in the ntds.dit database file. These base classes and attributes are known as Category 1 objects. Classes or attributes that applications or an administrator adds to the base DIT (e.g., attributes that Exchange 2000 Setup adds) are known as Category 2 objects.

The object category definition resides in classSchema and attributeSchema objects' systemFlags attribute. As its name implies, the systemFlags attribute contains bit flags that are on or off. The systemFlags attribute is 4 bytes long; bit 4 defines the category type. For a Category 1 object, bit 4 is set to on (i.e., it has the value 16 in decimal format); for a Category 2 object, the bit is set to off. If no other bit flags need to be set in a Category 2 object's systemFlags attribute, the attribute can be empty (i.e., not set). In ADSI Edit, the systemFlags attribute will then show a value of <not set>, which indicates that the object category is 2.

The object category is important because it reduces the chances that any schema changes an application makes will interfere with other applications. The category also restricts the type of schema changes that an application can make. (I'll discuss these restrictions in my next article.)

More Schema Help
The AD schema contains an abundance of data. Understanding schema objects and their interrelationships isn't easy but is worth the effort. Compaq has scripts that load information about all the schema objects into a Microsoft Excel spreadsheet. These scripts are part of a two-part white paper titled "Understanding the Microsoft Windows Script Host and the Active Directory Service Interfaces in Windows 2000" (Part 1) and "The Powerful Combination of Windows Script Host and Active Directory Service Interfaces under Windows 2000" (Part 2). To download the papers and scripts, visit Compaq's ActiveAnswers Web site (http://activeanswers.compaq
.com/aa_asp/solution_list.asp). Scroll down to Knowledge Mgmt. & Messaging, then Mail and Messaging. Click Microsoft Exchange Server. In the Available Information scroll box, choose Technology. (You might need to register as a user before you can access this site.) Click Windows 2000 and Exchange. For additional schema information sources, see the sidebar "Schema Details."

Now you have an insight into the AD schema's structure. Although Microsoft's terms can be confusing, perfecting your understanding of schema objects and how they relate to one another will give you the confidence you need to modify the schema to fit your business application requirements. My next article will explain the steps to take when you're ready to move ahead with schema extensions. Although you'll need to dedicate time to planning and testing your extensions, it will be time well spent.