AD DS Objects, Classes, and Attributes

What are objects, classes, and attributes?

Objects are created from classes, and classes have attributes

AD DS objects are created based on an object class. Attributes describe an object class. For example, Ed Meadows is an object created from the user class. Ed has all the attributes of the user class.

Each class has rules

Each class has rules that define which attributes are required and which are optional. For example, the user class consists of more than 400 possible attributes. This includes Common Name (cn), which is required, andManager, which is not required.

The schema rarely changes

Generally, the schema does not change very frequently. However, when some enterprise‑level applications (such as Microsoft Exchange Server) are introduced, some schema changes are required. These changes enable objects, including user objects, to have additional attributes. For example, email account information.

Active Directory Domain Service Schema (AD DS Schema)

What is the AD DS schema?

The AD DS schema defines your infrastructure

Information about your AD DS infrastructure is stored in the AD DS schema. The schema is a collection of objects. The schema defines:

• The AD DS objects that are part of the infrastructure.
• Rules that define the structure of the objects.
• The structure and content of the directory itself.

Every time that the directory handles data, the directory queries the schema for an appropriate object definition. Based on the object definition in the schema, the directory can create or modify an object and store the data.

Powershell - AD DS Schema

Try It: AD DS Schema

In this Try It you will use the ADSIEdit tool to view objects in the Active Directory database.  

Note: Don't delete or change objects within the Active Directory partitions as this can cause your Active Directory environment to stop working correctly. The following is just to help conceptualize where and how this data is stored and managed.

1. Logon to LON‑DC1 as Adatum\Administrator with the password Pa$$w0rd.
2. Open a PowerShell prompt and type ADSIEdit to start the LDAP editor.
3. ADSIEdit is a tool that can be used to view, change, create and delete any object in the Active Directory database.
4. In the console tree, right-click ADSI Edit, and then select Connect to...
5. In the Connection Point section, ensure that the Select a well known Naming Context dropdown menu displays Default naming context and then click OK.
6. As soon as you're successfully connected, in the console tree, double-click Default naming context [LON-DC1.Adatum.com],DC=Adatum,DC=com, double-click DC=Adatum,DC=com,  and then click OU=Managers.
7. Notice the different class types that are within the Managers object. For example, user and group.
8. To identify an object, you will use a Distinguished Name. For example, the Distinguished Name for Ed Meadows is as follows: CN=Ed Meadows,OU=Managers,DC=Adatum,DC=com.
9. Right-click CN=Ed Meadows and view the Properties.
10. Scroll through the Attributes and their associated Values.
11. As you have time, browse other parts of the AD DS database, but don't make any changes.