Registry Modification Required to Allow Write Operations to Schema

• Microsoft Windows 2000 Advanced Server
• Microsoft Windows 2000 Server
• Microsoft Windows 2000 Datacenter Server

SUMMARY

By default, Windows 2000 domain controllers permit only read access to the schema. This article describes how to edit the registry on a Windows 2000 domain controller to permit write operations to the schema.

NOTE: Even though the Active Directory is based on a multi-master administrative model, some operations allow only a single master. Schema management is one of these operations. Only one domain controller at a time is permitted to write to the schema. This role is known as Schema Flexible Single Master Operations (FSMO). You must ensure that the Active Directory Schema Manager snap-in is pointed at the schema FSMO. If you have only a single Windows 2000 domain controller in your network, it is always the schema FSMO.

MORE INFORMATION

WARNING: Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

For information about how to edit the registry, view the "Changing Keys and Values" Help topic in Registry Editor (Regedit.exe) or the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe. Note that you should back up the registry before you edit it. If you are running Windows NT, you should also update your Emergency Repair Disk (ERD).

Management of the Active Directory schema is not expected to be a frequently performed task and care must be exercised when modifying the schema. Windows 2000 has a new administrative group called Schema Administrators. Management of the schema is restricted to members of the Schema Administrators group.

A registry modification to allow write operations to the schema is necessary before a Schema Administrator can create and modify classes and attributes using the Active Directory Schema Manager snap-in.

To modify the registry to allow write operations to the schema, create a new REG_DWORD value named "Schema Updates Allowed" with a data value of "1" in the following registry key:

HKEY LOCAL MACHINE\System\Current Control Set\Services\NTDS\Parameters

Additional query words:

Keywords : kbenv
Version : WINDOWS:2000
Platform : WINDOWS
Issue type : kbhowto