Schema version entry count should be retrievable
AD-SCH-03InfoActive DirectorySchema
Part of Active Directory · Active Directory · Schema · All checks
Invoke-Maester -TestId AD-SCH-03Overview
Section titled “Overview”The Active Directory schema version indicates the functional level and capabilities of your directory. Different schema versions correspond to different Windows Server releases:
| Schema Version | Windows Server Version |
|---|---|
| 13 | Windows 2000 |
| 30 | Windows Server 2003 |
| 44 | Windows Server 2008 |
| 47 | Windows Server 2008 R2 |
| 56 | Windows Server 2012 |
| 69 | Windows Server 2012 R2 |
| 87 | Windows Server 2016 |
| 88 | Windows Server 2019/2022 |
Knowing your schema version is important for:
- Compatibility: Ensuring applications support your schema version
- Feature availability: Understanding what AD features are available
- Upgrade planning: Determining if schema updates are needed
- Security: Newer schema versions support enhanced security features
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Keep your schema version current with your domain functional level:
- Regular updates: Update schema when upgrading domain controllers
- Feature enablement: Newer schemas enable security features like Authentication Policies
- Application support: Modern applications may require newer schema versions
How the Test Works
Section titled “How the Test Works”This test retrieves the objectVersion attribute from the schema container to determine the current schema version and maps it to the corresponding Windows Server version.
Related Tests
Section titled “Related Tests”Test-MtAdSchemaVersionDetails- Provides comprehensive schema detailsTest-MtAdSchemaModificationYearCount- Shows schema modification timelineTest-MtAdDomainFunctionalLevel- Shows domain functional level
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-SCH-03 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Schema |
| Area | Infrastructure hardening |
| Resource type | Tenant |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdSchemaVersionEntryCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:Schema/*.objectVersion:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/schema/Test.AD-SCH-03.ps1 - Documentation:
tests/ad/schema/Test.AD-SCH-03.md