How to Check the Active Directory Schema Version - Unpublished

Aug 19, 2024

How to Check the Active Directory Schema Version - Unpublished

Introduction

Certificate Automation Manager constantly interacts with Active Directory (AD) objects during the Certificate enrollment process. The AD Schema version is a description of all directory objects and attributes of the Windows domain. The AD Schema reflects the basic structure of the catalog and is critical for its proper functioning. Usually, the Schema version requires an update when you add a new Domain Controller (DC) with a new version of Windows Server.

• Certificate Automation Manager requires an AD Schema version of Windows Server 2008 R2 (objectVersion 47) or higher.

The Schema version is associated with the objectVersion property, which is expressed as a number. Below, we provide the list of Windows Server versions and their corresponding objectVersion (Schema version) value.

Guidelines

There are three ways to find your current AD Schema version. You can use the Server Manager, the PowerShell, or the Command Prompt. In this article, we show you the steps to use any of those tools.

Using the Server Manager

1. Log in to your Active Directory Domain Controller. Note: If you have more than one domain controller, you should log in to the forest root domain controller.

2. Open the Server Manager, click Tools, and click ADSI Edit.

   

3. Right-click the ADSI Edit and click Connect to…

   

4. Click the radio button next to Select a well known Naming Context, select Schema from the drop-down menu, and click OK.

   

5. Expand the container that starts with Schema [FQDN_of_your_DC].

   

6. Right-click on the first folder on the list and click Properties.

   

7. On the Attribute Editor tab, scroll down until you find the objectVersion property.

   

8. Compare the value that is shown there against the ones provided in the table above. In this case, the objectVersion value is 87, which corresponds to an AD Schema version of Windows Server 2016.

Using the PowerShell

1. Log in to your Active Directory Domain Controller. Note: If you have more than one domain controller, you should log in to the forest root domain controller.

2. Click the Start Menu, right-click Windows PowerShell, hover over More, and click Run as administrator.

   

3. If there is a pop-up screen from the User Account Control, or UAC, asking if you want to allow the app to make changes, click Yes.

   

4. Run the command Get-ADObject (Get-ADRootDSE).schemaNamingContext -Property objectVersion.

   

5. Compare the objectVersion value from the results against the table above. In this case, the objectVersion value is 87, which corresponds to an AD Schema version of Windows Server 2016.

Using the Command Prompt

1. Log in to your Active Directory Domain Controller. Note: If you have more than one domain controller, you should log in to the forest root domain controller.

2. Click Start Menu, right-click Command Prompt, hover over More, and click Run as administrator.

   

3. Run the command dsquery * cn=schema,cn=configuration,dc=<your_domain_name>,dc=<your_domain_suffix> -scope base -attr objectVersion.

   

4. Compare the objectVersion value from the results against the table above. In this case, the objectVersion value is 87, which corresponds to an AD Schema version of Windows Server 2016.

After you have checked the AD Schema version, you should know your objectVersion value. If the objectVersion value is lower than 47, which corresponds to an AD Schema version of Windows Server 2008 R2, you will need to modify the value prior to deploying Certificate Automation Manager.