# Schema version entry count should be retrievable

The Active Directory schema version indicates the functional level and capabilities of your directory.

Source: https://maester.dev/docs/tests/AD-SCH-03

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Schema · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-SCH-03
```

## Overview

The Active Directory schema version indicates the functional level and capabilities of your directory. Different schema versions correspond to different Windows Server releases:

| Schema Version | Windows Server Version |
|----------------|----------------------|
| 13 | Windows 2000 |
| 30 | Windows Server 2003 |
| 44 | Windows Server 2008 |
| 47 | Windows Server 2008 R2 |
| 56 | Windows Server 2012 |
| 69 | Windows Server 2012 R2 |
| 87 | Windows Server 2016 |
| 88 | Windows Server 2019/2022 |

Knowing your schema version is important for:
- **Compatibility**: Ensuring applications support your schema version
- **Feature availability**: Understanding what AD features are available
- **Upgrade planning**: Determining if schema updates are needed
- **Security**: Newer schema versions support enhanced security features

#### Control Type

**Operational**

#### Security Recommendation

Keep your schema version current with your domain functional level:
- **Regular updates**: Update schema when upgrading domain controllers
- **Feature enablement**: Newer schemas enable security features like Authentication Policies
- **Application support**: Modern applications may require newer schema versions

#### How the Test Works

This test retrieves the objectVersion attribute from the schema container to determine the current schema version and maps it to the corresponding Windows Server version.

#### Related Tests

- `Test-MtAdSchemaVersionDetails` - Provides comprehensive schema details
- `Test-MtAdSchemaModificationYearCount` - Shows schema modification timeline
- `Test-MtAdDomainFunctionalLevel` - Shows domain functional level

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-SCH-03 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Schema |
| Area | Infrastructure hardening |
| Resource type | Tenant |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtAdSchemaVersionEntryCount](https://github.com/maester365/maester/blob/main/tests/ad/schema/Test.AD-SCH-03.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:Schema/*.objectVersion:ReadProperty |

</details>

## Source

- Test: [`tests/ad/schema/Test.AD-SCH-03.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/schema/Test.AD-SCH-03.ps1)
- Documentation: [`tests/ad/schema/Test.AD-SCH-03.md`](https://github.com/maester365/maester/blob/main/tests/ad/schema/Test.AD-SCH-03.md)