Active Directory Schema
Active Directory Schema |
|
The schema enforces rules that govern both the structure and the content of Active Directory. When you add, delete, or modify objects, validation takes place by using these schema rules to ensure the integrity of the directory. Structure rules define the possible tree structures. When you create a new object, structure rules determine the validity of the object class to which you designate the new object. You cannot create an object that belongs to a nonexistent class. You must first create the new class. Conversely, these rules do not allow you to delete or modify an object that has already been deleted. In Active Directory, the structure rules are completely expressed by the possSuperiors and systemPossSuperiors attributes that are present on each classSchema object. These attributes specify the possible classes that can be parents of an object instance of the class in question. In other words, the possSuperiors and systemPossSuperiors attribute values determine the object classes and, hence, the location in the Directory Information Tree under which objects of the class in question can be instantiated.
Content rules determine the mandatory and optional attributes of the class instances that are stored in the directory. New objects must contain all of the mandatory attributes that are specified by the classSchema object in the schema and can contain any of the optional attributes. In Active Directory, the content rules are completely expressed by the mustHave, mayHave, mayContain, systemMustContain, and systemMayContain attributes of the schema definitions for each class. In addition, specific marked attributes have additional restrictions imposed by the Security Account Manager (SAM). SAM read-only objects consist of the following:
revision, objectSID, domainReplica, creationTime modifiedCount, modifiedCountAtLastPromotion, nextRID, serverState, samAccountType, isCriticalSystemObject, dbcsPwd, ntPwdHistory,lmPwdHistory, lastLogon, lastLogoff, badPasswordTime, badPwdCount ,logonCount, supplementalCredentials
Below are some other attributes on which SAM enforces special checks:
sAMAccountName. Domain-wide uniqueness, without replication latency,
Member. Membership rules as defined in Windows 2000 groups.
userWorkstations. Must be valid computer names.
primaryGroupID. For a user/computer account, must point to a group and the user /computer account must be a member of the group; the group and the user must be in the same domain. If the computer is a domain controller, the primary group must be the domain controllers group.
LockoutTime. For a user or computer object. Only legal value that can be written is 0 to clear an account.
LockoutPasswordLastset. The system normally writes to it, but two special values can be written 0
For more information about these attributes, see the Microsoft Platform SDK link on the Web Resources page at http://windows.microsoft.com/windows2000/reskit/webresources.