# Schema modification year count should be retrievable

Understanding when your Active Directory schema has been modified provides important visibility into the evolution of your directory infrastructure.

Source: https://maester.dev/docs/tests/AD-SCH-01

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Schema · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-SCH-01
```

## Overview

Understanding when your Active Directory schema has been modified provides important visibility into the evolution of your directory infrastructure. Schema modifications typically occur during:

- **Domain upgrades**: When upgrading to newer Windows Server versions
- **Application installations**: Products like Exchange, Skype for Business, and third-party applications extend the schema
- **Custom developments**: Organizations may add custom attributes or classes

Tracking schema modification years helps:
- **Audit trail**: Understand when major changes occurred
- **Compliance**: Document directory evolution for compliance purposes
- **Troubleshooting**: Correlate issues with schema change timeframes
- **Planning**: Identify when the directory was last updated

#### Control Type

**Operational**

#### Security Recommendation

While schema modifications are normal and necessary, they should be:
- **Documented**: All schema changes should be recorded with business justification
- **Planned**: Schema changes should go through change control processes
- **Tested**: Schema extensions should be tested in a lab environment first
- **Authorized**: Only privileged administrators should have schema admin rights

#### How the Test Works

This test retrieves all schema objects and analyzes their creation dates to identify:
- How many different years have had schema modifications
- The total number of schema objects
- The first and most recent schema changes

#### Related Tests

- `Test-MtAdSchemaModificationYearDetails` - Provides detailed breakdown by year
- `Test-MtAdSchemaVersionEntryCount` - Shows the current schema version
- `Test-MtAdSchemaVersionDetails` - Provides comprehensive schema information

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-SCH-01 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Schema |
| Area | Infrastructure hardening |
| Resource type | Tenant |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtAdSchemaModificationYearCount](https://github.com/maester365/maester/blob/main/tests/ad/schema/Test.AD-SCH-01.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:Schema/*:ReadProperty |

</details>

## Source

- Test: [`tests/ad/schema/Test.AD-SCH-01.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/schema/Test.AD-SCH-01.ps1)
- Documentation: [`tests/ad/schema/Test.AD-SCH-01.md`](https://github.com/maester365/maester/blob/main/tests/ad/schema/Test.AD-SCH-01.md)