Impact of Schema Changes

A schema extension has the following impact on an Active Directory™ forest:

• Schema changes are global. There is a single schema for an entire forest. The schema is globally replicated: a copy of the schema exists on every DC in the forest. When you extend the schema, you do so for the entire forest.
• Schema object additions are not reversible. Once a new class or attribute object has been added to the schema, it cannot be removed. An existing attribute or class can be disabled, but not removed (see Disabling Existing Classes and Attributes). Disabling a class or attribute does not affect existing instances of the class or attribute, but it prevents new instances from being created. You cannot disable an attribute if it is included in any class that is not disabled.
• OIDs must be unique. Once an attribute or class has been added to the schema, no attribute or class with the same OID can be added. This is true even if a class or attribute has been disabled. For this reason it is very important that you use valid OIDs. Do not "make up" an OID, and do not "recycle" an OID that you have previously used. Valid OIDs are easily obtained, see Obtaining a Root Object Identifier (OID) for details.
• Some changes can be made after creation:
  • For a category 1 or category 2 class, you can add or remove values in the possSuperiors attribute. The possSuperiors values specify the object classes that can contain the class.
  • For a category 1 or category 2 class, you can add or remove values in the mayContain attribute. The mayContain values specify the attributes that are not mandatory but may be present in an instance of the class.
• The lDAPDisplayName for a Category 2 class or attribute can be changed after it has been created. Typically, you should not change the lDAPDisplayName. However, there is one legitimate reason for changing the LDAP name and that is if you made a mistake in defining the attribute or class and want to create a new one to replace the old one. You do not have to rename the relative distinguished name (RDN) of the attribute or class schema to achieve this. Changing the LDAP name enables you to work around a mistake rather than rebuilding your whole Microsoft® Windows® 2000 infrastructure or living with the mistake forever. For more information, see Disabling Existing Classes and Attributes.

  The lDAPDisplayName for predefined (category 1) classes or attributes cannot be changed. For information on category 1 and 2 schema objects, see Restrictions on Schema Extension.