Re: AD Schema extension and ACLing

LDIFDE in export mode (default) will produce an LDIF file for you. It's a
bit stupid and dumps a couple of constructed or system-only attributes that
need to be excluded, e.g. whenChanged, but otherwise works fine.

If you have some schema extensions and want an LDIF file of those, there's
also the schema analyser tool that ships with ADAM SP1 (R2).

An example can be found here:
--
http://www.microsoft.com/technet/itsolutions/network/wifi/vista_ad_ext.mspx


Basically, you have something like this:

dn: cn=new-attr,cn=schema,cn=configuration,dc=domain-name,dc=com
changeType: ntdsSchemaAdd
objectClass: attributeSchema
ldapDisplayName: newAttribute
attributeId: <ID goes here>
attributeSyntax: 2.5.5.3
omSyntax: 27
isSingleValued: TRUE

# reload the cache
dn:
changetype: modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

# class
dn: cn=new-class,cn=schema,cn=configuration,dc=domain-name,dc=com
changeType: ntdsSchemaAdd
objectClass: attributeSchema
ldapDisplayName: newClass
governsId: <ID goes here>
objectClassCategory: 3
rDNAttID: cn
mayContain: newAttribute


--
Paul Williams
Microsoft MVP - Windows Server - Directory Services
http://www.msresource.net | http://forums.msresource.net



.

Relevant Pages

  • RE: Ldif errors when importing schema extensions
    ... from ldif file: ... objectClass: attributeSchema ... adminDisplayName: eySubManagementUnit ...
    (microsoft.public.windows.server.active_directory)
  • Schema Mismatch Causes Excessive WAN Activity
    ... The installation failed at the point where the schema was being updated. ... Extending Schema with SFU Schema Version '30'. ... Creating SFU attributeSchema objects. ... Failed to update SFU schema entity: 'msSFU-30-Top' with the following ...
    (microsoft.public.windows.server.active_directory)
  • RE: Using LDAP to make schema mods
    ... We have not provided the documentation for the whole parameter and syntax. ... we export a exist objects to a LDIF file and modify them. ... 283791 How to Modify Schema Information Using the Ldifde Utility ... | adminDisplayName: soton-MailHost ...
    (microsoft.public.windows.server.active_directory)
  • RE: Schema Mismatch Causes Excessive WAN Activity
    ... schema values as the second attempt last week. ... Failed to update SFU schema entity: 'msSFU-30-Top' with the following ... Creating SFU attributeSchema objects. ...
    (microsoft.public.windows.server.active_directory)
  • RE: Schema Mismatch Causes Excessive WAN Activity
    ... Notice that every time you attempted schema update, ... Failed to update SFU schema entity: 'msSFU-30-Top' with the following ... Creating SFU attributeSchema objects. ...
    (microsoft.public.windows.server.active_directory)
Loading