Upgrading Active Directory Schema

7.8K

This tutorial explains how to upgrade the Active Directory schema to Windows Server 2025.

You may need Schema updates when introducing a new Windows Server version or enabling features that depend on new attributes.

Important. You should plan and test Schema changes carefully before applying in production because they affect the entire forest and you can’t roll them back.

What is Active Directory Schema (and why it matters for upgrades)

The Active Directory schema defines which objects and attributes can exist in your domain.

You may need Schema updates when:

• You install a newer version of Windows Server
• You enable new AD features
• You deploy applications that extend the schema (e.g., Exchange, SCCM)

Ways to Update Active Directory Schema (When to Use Each)

There are two ways to upgrade the AD schema, and the choice depends on your case:

Automatic — recommended when adding a new DC

• AD DS promotion wizard runs the required preparation automatically.
• Best choice for most new-DC deployments.

Manual ADPrep — useful when you want to pre-stage AD

• Run preparation before DC promotion.
• Useful for controlled enterprise change windows and multi-domain forests.

Check the Active Directory Schema Version on Windows Server

At first, find the current schema version in the AD domain.

Using PowerShell to Verify Schema Version

Use PowerShell to check the objectVersion property in the domain configuration:

Get-ADObject (Get-ADRootDSE).schemaNamingContext -Properties objectVersion

The objectVersion value shows your current AD schema version.

Here is how to interpret the result:

• 88 → Windows Server 2019/2022
• 91 → Windows Server 2025

So, what does those results mean?

• In case your version of AD Schema is lower than the target version (for example, 88 when upgrading to 2025), you must upgrade the schema
• In case the Schema version already matches the target, you don’t need to upgrade Schema

Schema Version	Windows Server
87	2016
88	2019/2022
91	2025

Manual AD Schema Upgrade with ADPREP (Step-by-Step)

Step 1. Check Domain and Forest Functional Levels

Before introducing a Windows Server 2025 DC into an existing AD domain, you need to check if the domain and forest functional levels meet the Windows Server 2025 requirements. For an existing domain, Windows Server 2025 DCs require the domain functional level to be Windows Server 2016 or later.

To check the current domain and forest functional levels, use the following command:

Get-ADDomain | Select-Object Name, DomainMode
Get-ADForest | Select-Object Name, ForestMode

For example, an existing environment may show:

DomainMode : Windows2016Domain
ForestMode : Windows2016Forest

This config supports Windows Server 2025 domain controllers.

Important. Note that you do not need to raise the domain and forest functional levels to Windows Server 2025 before introducing a Windows Server 2025 DC. Windows Server 2025 DCs can coexist with Windows Server 2016, 2019, and 2022 DCs at the Windows Server 2016 functional level.

Keep in mind that in case the existing domain is running a functional level below Windows Server 2016, you must resolve this before attempting to promote a Windows Server 2025 DC.

Step 2. Verify prerequisites

Before running ADPREP, you need ensure that your AD is healthy (there are no replication or DNS errors).

 

Also check that you are logged in with:

• Enterprise Admins
• Schema Admins
• Domain Admins
• You are running commands on the Schema Master

Important. You should create a system state backup of the Schema Master DC before running ADPREP:

wbadmin start systemstatebackup -backuptarget:E:

Keep in mind that Schema changes cannot be rolled back — a backup is your only recovery option if something goes wrong.

Step 3. Mount Windows Server installation media

At this step, insert/mount the Windows Server 2025 ISO and navigate to D:\support\adprep.

Step 4. Run forest schema update

Run the command:

adprep.exe /forestprep

With this step, you will update schema for the entire forest. Note that it must be run once per forest (confirm with C when prompted).

Step 5. Run domain update

To update the domain, run the command:

adprep /domainprep

This step updates domain-specific settings and must be run within each domain.

Step 6. (Optional) Prepare for RODC

Run the following command only if you have Read-Only Domain Controllers:

adprep /rodcprep

Step 7. Verify schema upgrade

Now you need to verify schema upgrade. Run the following command:

Get-ADObject (Get-ADRootDSE).schemaNamingContext -Properties objectVersion

The expected result is 91, it means that the Schema was successfully upgraded to Windows Server 2025.

Automatic Schema Upgrade (During DC Promotion)

During promotion, the AD DS Configuration Wizard checks whether the forest and domain have already been prepared and runs the required AD preparation steps when necessary. During promotion, Windows performs:

• Forest schema update
• Domain preparation

You will notice this step in the wizard: Forest and schema preparation.

Important.

• The wizard runs only the preparation steps that are required.
• Forest-wide schema preparation occurs once per forest.
• In a multi-domain forest, domain preparation may be required for each domain.
• If the forest has already been prepared, the wizard does not repeat the completed schema preparation.

Schema Update Confirmation

After the DC promotion, the server reboots. Next, run the following command to confirm the new DC deployment:

Get-ADDomainController -Filter * | Select-Object Name, OperatingSystem

Post-Schema Update Tasks

After upgrading the schema, you need to perform the steps below.

Required (recommended in most cases)

First, verify that the replication is working correctly with the command:

repadmin /replsummary

Now you need to ensure that all DCs are healthy:

dcdiag /a /q

Optional (depending on your upgrade case)

1. You need to transfer FSMO roles to a new DC (in case you are deploying a new DC)
2. Then demote old DCs (if they are being replaced) with the command:

   Uninstall-ADDSDomainController

3. Now raise Forest and Domain Functional Levels (after all DCs are upgraded)

Important

Keep in mind that you don’t need to perform these steps blindly. Follow these steps only:

• You need to transfer FSMO roles in case you are introducing a new primary DC
• You should demote DCs only after verifying replication and stability

Schema Extensions for Applications

Note that some enterprise apps (like Exchange Server) extend the Active Directory schema.

In such scenarios:

• You need to always follow vendor-specific documentation
• You should perform Schema updates separately from Windows Server upgrades

Wrapping up

You should always verify the following before updating the AD schema:

• Active Directory health (replication, DNS, time sync)
• Schema version and target version
• Proper permissions (Enterprise + Schema Admins)
• Ensure you are using the correct update method (automatic or ADPREP)

After the Schema update, you need to confirm:

• That the Schema version has been upgraded successfully
• That replication is working across all DCs
• SYSVOL and Netlogon shares are available

In case any of these checks fail, you shouldn’t proceed with further changes until the issues are resolved.