Schema modification year count should be retrievable
AD-SCH-01InfoActive DirectorySchema
Part of Active Directory · Active Directory · Schema · All checks
Invoke-Maester -TestId AD-SCH-01Overview
Section titled “Overview”Understanding when your Active Directory schema has been modified provides important visibility into the evolution of your directory infrastructure. Schema modifications typically occur during:
- Domain upgrades: When upgrading to newer Windows Server versions
- Application installations: Products like Exchange, Skype for Business, and third-party applications extend the schema
- Custom developments: Organizations may add custom attributes or classes
Tracking schema modification years helps:
- Audit trail: Understand when major changes occurred
- Compliance: Document directory evolution for compliance purposes
- Troubleshooting: Correlate issues with schema change timeframes
- Planning: Identify when the directory was last updated
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”While schema modifications are normal and necessary, they should be:
- Documented: All schema changes should be recorded with business justification
- Planned: Schema changes should go through change control processes
- Tested: Schema extensions should be tested in a lab environment first
- Authorized: Only privileged administrators should have schema admin rights
How the Test Works
Section titled “How the Test Works”This test retrieves all schema objects and analyzes their creation dates to identify:
- How many different years have had schema modifications
- The total number of schema objects
- The first and most recent schema changes
Related Tests
Section titled “Related Tests”Test-MtAdSchemaModificationYearDetails- Provides detailed breakdown by yearTest-MtAdSchemaVersionEntryCount- Shows the current schema versionTest-MtAdSchemaVersionDetails- Provides comprehensive schema information
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-SCH-01 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Schema |
| Area | Infrastructure hardening |
| Resource type | Tenant |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdSchemaModificationYearCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:Schema/*:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/schema/Test.AD-SCH-01.ps1 - Documentation:
tests/ad/schema/Test.AD-SCH-01.md