Schema modification year details should be retrievable
AD-SCH-02InfoActive DirectorySchema
Part of Active Directory · Active Directory · Schema · All checks
Invoke-Maester -TestId AD-SCH-02Overview
Section titled “Overview”Detailed visibility into schema modifications by year provides a comprehensive timeline of your Active Directory’s evolution. This information is valuable for:
- Capacity planning: Understanding growth patterns of the directory
- Change management: Tracking when major applications were deployed
- Security auditing: Identifying unauthorized or unexpected schema changes
- Compliance reporting: Documenting directory modifications for auditors
Unexpected spikes in schema modifications may indicate:
- Unauthorized application deployments
- Malicious schema extensions
- Improper testing procedures
- Lack of change control
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Establish monitoring for schema changes:
- Alert on schema modifications: Configure alerts when schema changes occur
- Regular reviews: Periodically review schema modification history
- Access controls: Limit Schema Admins group membership
- Audit logging: Enable auditing for schema changes
How the Test Works
Section titled “How the Test Works”This test analyzes schema objects and groups them by creation year, providing:
- Count of schema objects created per year
- Percentage distribution across years
- Timeline of directory evolution
Related Tests
Section titled “Related Tests”Test-MtAdSchemaModificationYearCount- Shows count of years with modificationsTest-MtAdSchemaVersionEntryCount- Shows current schema versionTest-MtAdSchemaVersionDetails- Provides comprehensive schema details
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-SCH-02 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Schema |
| Area | Infrastructure hardening |
| Resource type | Tenant |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdSchemaModificationYearDetails |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:Schema/*:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/schema/Test.AD-SCH-02.ps1 - Documentation:
tests/ad/schema/Test.AD-SCH-02.md