AEG: How to Check the Active Directory Schema Version

AEG: How to Check the Active Directory Schema Version

Introduction

AEG constantly interacts with Active Directory (AD) objects during the Certificate enrollment process. The AD Schema version is a description of all directory objects and attributes of the Windows domain. The AD Schema reflects the basic structure of the catalog and is critical for its proper functioning. Usually, the Schema version requires an update when you add a new Domain Controller (DC) with a new version of Windows Server.

  • AEG requires an AD Schema version of Windows Server 2008 R2 (objectVersion 47) or higher.

The Schema version is associated with the objectVersion property, which is expressed as a number. Below, we provide the list of Windows Server versions and their corresponding objectVersion (Schema version) value.

Windows Server version objectVersion value
Windows Server 2000 13
Windows Server 2003 30
Windows Server 2003 R2 31
Windows Server 2008 44
Windows Server 2008 R2 47
Windows Server 2012 56
Windows Server 2012 R2 69
Windows Server 2016 87
Windows Server 2019 88

Guidelines

There are three ways to find your current AD Schema version. You can use the Server Manager, the PowerShell, or the Command Prompt. In this article, we show you the steps to use any of those tools.

Using the Server Manager

  1. Log in to your Active Directory Domain Controller. Note: If you have more than one domain controller, you should log in to the forest root domain controller.

  2. Open the Server Manager, click Tools, and click ADSI Edit.

  3. Right-click the ADSI Edit and click Connect to…

  4. Click the radio button next to Select a well known Naming Context, select Schema from the drop-down menu, and click OK.

  5. Expand the container that starts with Schema [FQDN_of_your_DC].

  6. Right-click on the first folder on the list and click Properties.

  7. On the Attribute Editor tab, scroll down until you find the objectVersion property.

  8. Compare the value that is shown there against the ones provided in the table above. In this case, the objectVersion value is 87, which corresponds to an AD Schema version of Windows Server 2016.


Using the PowerShell

  1. Log in to your Active Directory Domain Controller. Note: If you have more than one domain controller, you should log in to the forest root domain controller.

  2. Click the Start Menu, right-click Windows PowerShell, hover over More, and click Run as administrator.

  3. If there is a pop-up screen from the User Account Control, or UAC, asking if you want to allow the app to make changes, click Yes.

  4. Run the command Get-ADObject (Get-ADRootDSE).schemaNamingContext -Property objectVersion.

  5. Compare the objectVersion value from the results against the table above. In this case, the objectVersion value is 87, which corresponds to an AD Schema version of Windows Server 2016.


Using the Command Prompt

  1. Log in to your Active Directory Domain Controller. Note: If you have more than one domain controller, you should log in to the forest root domain controller.

  2. Click Start Menu, right-click Command Prompt, hover over More, and click Run as administrator.

  3. Run the command dsquery * cn=schema,cn=configuration,dc=<your_domain_name>,dc=<your_domain_suffix> -scope base -attr objectVersion.

  4. Compare the objectVersion value from the results against the table above. In this case, the objectVersion value is 87, which corresponds to an AD Schema version of Windows Server 2016.

After you have checked the AD Schema version, you should know your objectVersion value. If the objectVersion value is lower than 47, which corresponds to an AD Schema version of Windows Server 2008 R2, you will need to modify the value prior to deploying AEG.

Related Articles

GlobalSign System Alerts

View recent system alerts.

View Alerts

Certificate Inventory Tool

Please click the button below to log in or sign up.

Log In - Sign Up

SSL Configuration Test

Check your certificate installation for SSL issues and vulnerabilities.