Schema Master is an FSMO domain controller role that is responsible for making changes to the Active Directory schema. The schema stores descriptions of all Active Directory classes and attributes. The schema partition exists on all DCs, it is named “schema naming context”, and located in LDAP://cn=schema,cn=configuration,dc=<domain>.
Domain administrators make changes to the AD schema quite rarely: for example, when you need to extend the schema using adprep/forestprep, upgrade the domain functional level, or install Exchange Server, Skype for Business Server, or other enterprise application that stores object configuration and properties in an Active Directory partition.
Overview of Schema Master Role in Active Directory Domain
There can be only one domain controller with the Schema Master role in the AD forest (it’s an enterprise-level FSMO role). Only a domain controller that owns this role can make changes to the Active Directory schema (contains a read-write copy of schema partition). After updating the forest schema, the changes are replicated from the schema master server to other domain controllers in the AD forest. This role is necessary to prevent conflicting schema changes from two domain controller servers.
The AD schema is a set of objects and their attributes used to store different data. On the screenshot below you can see the user class in the AD schema, that defines all the available attributes of the user account object (like employee ID, phone number, email address, SamAccountName and UserPrincipalName, etc.).
You can fill in all of these attributes for any domain user account. You can view the attributes for any domain user account and their values using the ADUC console or the ADSIEdit.msc tool. All the tabs and information you see about the properties of any Active Directory object are AD schema.
For example, you want to check the user attribute values for a built-in domain administrator account using the ADSIEdit.
Open the adsiedit.msc console and connect to the Default naming context. Find the user object in the AD hierarchy and open its Properties.
You can see the object has all the attributes that are defined in the user class (you can display only attributes that have values by pressing the Filter button).
Microsoft recommends the following best practices in placement and administration of the Active Directory schema:
- Always make an AD backup before changing the schema. Before the process of schema changes, you can shut down all domain controllers except the FSMO Schema Master role owner. After that, make a system state backup for the domain controller, perform all the necessary changes, and in case everything is well, simply turn on all DCs. If something went wrong, just restore the running controller from a previous backup, turn on the rest DCs, and then explore the problem;
- It is recommended to keep the Domain Naming Master and Schema Master roles on the same DC (they are rarely used and should be strictly controlled), which should be a Global Catalog (GC) server simultaneously;
- If you have lost the server with the Schema Master role, you can seize this role to any other domain controller. But keep in mind that the original Schema Master should not appear on the network after that;
- Perform manual schema changes only in case of extra need. If it needs to be done in any case, see paragraph 1.
If the DC owner of a Schema Master role is unavailable, it is not possible to change the AD schema. However, the upgrade of the schema is usually not performed often (as a rule, when installing new DCs with a newer Windows Server version or installing some other enterprise products, such as Exchange). Temporary loss of the DC running FSMO Schema Master is not noticeable for domain users. In practice, the Schema Master role owner can remain offline for years without noticeable effect. If the server running Schema master role is broken, you can simply assign this role to any other online domain controller.
To manage AD schema and transfer the Schema Master role between domain controllers, use the Active Directory Schema mmc snap-in. However, to enable this console you must register the dynamic library Schmmgmt.dll at first.
- Open the elevated Command prompt;
- Run the command:
To manage an AD schema you must be a member of the Schema Admins security group. By default, only the built-in domain administrator account is a member of this Active Directory group.
For security reasons, Microsoft does not recommend adding other administrator accounts to the Schema Admins group. If you need to make changes to the AD schema, add your account to this group, log in to DC under your account, perform the desired schema modification operation, and remove your account from the group. The Schema Admins group is only needed to modify the AD schema; it doesn’t grant any additional permissions in Active Directory.
You can add or remove the admin account to Schema Admins group using the ADUC console or using PowerShell:
Add-ADGroupMember -Identity "Schema Admins" B.Jackson Remove-ADGroupMember -Identity "Schema Admins" B.Jackson
How to Check the Active Directory Schema Version?
Each time you install a new domain controller in your domain with a new version of Windows Server, you update the version of the Active Directory schema. The following table lists all versions of Active Directory schemas:
|Windows Server version||AD Schema objectVersion|
|Windows 2003 R2||31|
|Windows 2008 R2||47|
|Windows 2012 R2||69|
|Windows Server 2016||87|
|Windows Server 2019||88|
|Windows Server 2022||88|
You can find out the current version of the schema in your domain using PowerShell:
Get-ADObject (Get-ADRootDSE).schemaNamingContext -Property objectVersion
In this case, the AD schema version (objectVersion) is 87. It corresponds to the AD version of Windows Server 2016.
Moving Schema Master Role to Another Domain Controller
The Schema Master role is installed by default on the first DC in the first domain in the AD forest. You can move this FSMO role to any domain controller within the forest. But keep in mind that if the Schema Master is not available, it won’t be possible to change the AD schema.
If the DC host running the Schema Master role is broken, you can assign (move) the role to any other online domain controller.
Information about who currently holds the Schema Master FSMO role in the domain is contained in the attribute of the root object CN = Schema – fSMORoleOwner:
You can find the current FSMO role holders in the domain using the following command:
netdom query fsmo
To identify the FSMO role owners that are not in the current domain, use the command:
netdom query fsmo /domain:<DomainName>
Schema master DC1.theitbros.com
Domain naming master DC1.theitbros.com
RID pool manager DC07.corp.theitbros.com
Infrastructure master DC07.corp.theitbros.com
The command completed successfully.
You can also quickly find the Schema master owner using the following PowerShell command:
Get-ADForest theitbros.com| ft SchemaMaster
То transfer Schema Master FSMO role you need to run the AD Schema console.
- Open mmc.exe;
- Click File > Add/Remove snap-in;
- Select Active Directory Schema item and press Add > OK;
- Right click on the root of the console, select Change Active Directory Domain Controller, and select the DC on which you want to transfer the role;
- Next, select Operation Masters and press the Change button;
Tip. You can’t change the Schema Master role owner from the source server.
Also, you can use the PowerShell cmdlet Move-ADDirectoryServerOperationMasterRole to transfer any of the FSMO roles in the AD forest. To use this cmdlet you need to install and import the Active Directory for Windows PowerShell module (check this article).
For example, to transfer the Schema Master role to a domain controller DC02, run the command:
Move-ADDirectoryServerOperationMasterRole -Identity "dc2" SchemaMaster
Move-ADDirectoryServerOperationMasterRole -Identity "dc2" –OperationMasterRole 3
To forced seizing of the FSMO role owner with the PowerShell, use the –Force option in the above PowerShell commands. The FSMO role is forcibly sized if the role owner’s domain controller fails to boot, is broken, or cannot be recovered.
Also, you can transfer the Schema master role using the ntdsutil tool.
- Run the elevated cmd on the DC and type the ntdsutil command;
- Type: roles;
- On the FSMO Maintenance prompt type: connections;
- Specify the DC name on which you want to transfer the FSMO role: connect to server DC2;
- On the server connection prompt type: q;
- To move the Schema master on the current DC: Transfer Schema Master;
- Press Yes in the prompt dialog.
Now you can check the current Schema Master role owner.