Security concerns of extended schema in Active Directory

    Requires Free Membership to View

More Information

Learn about Active Directory's inherent security capabilities

Submit your questions about Active Directory to SearchSecurity's identity management and access control to expert Joel Dubin

The structure of Active Directory -- the formatting of records, the type of information stored in it, etc. -- is referred to as its schema. Since AD is basically a database, the default schema is not set in stone and it can in fact be changed if needed. That said, extending the AD schema is not something you want to do trivially. The presence of third-party products that do this can complicate the issue, especially as far as security is concerned.

The first thing to be conscious of when using these products is that any additions to the schema are typically available by default in a read-only fashion to everyone. If you extend the schema, you also need to take into account what kind of access to grant to the new schema elements -- who gets to add or change these new elements, whether or not they can be seen by most users, etc.

Likewise, if you're extending the schema to work with a custom or third-party application (or if the app itself is making the changes), you should regard those changes as a possible security hole unless they are explicitly dealt with by the app itself or by work you do.

Also, schema changes cannot be undone without rolling back the AD store as a whole. You can modify or deactivate a given class or attribute, but changes cannot be deleted completely. If you can spare the time and resources, set up an isolated test forest (perhaps via Microsoft Virtual Server) where you can try out the results of your schema extensions in a controlled way. If the extensions you're considering are pretty major or may have an impact on the way AD is routinely accessed and changed, it will absolutely be worth the time and effort.

About the Author:
Serdar Yegulalp is editor of the Windows Power Users Newsletter.

This tip originally appeared on SearchWindowsSecurity.com

This was first published in June 2006

There are Comments. Add yours.

TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.