Did You Know 3: AD Schema Troubleshooting Flow

This is not something new and the are many methods that are circulating around the internet to troubleshoot the issue. Here are some of the personal finding and preference to resolve the issue. 

Problem: 

Upon extending the schema, you saw error code 8202 in the log file. And you realise that the AD schema extension is not complete

Steps: 

1) Make you that the AD account your are using has Enterprise Admin and Schema Admin rights. 

2) Ensure that the replication partners are all there in AD. This can be easily achieve when you go into the console of "AD sites and services" Make sure all the DC are replication partners this is to ensure that the extension is replicated across the DC

3) Ensure that the DC you are working at has the Schema master FMSO roles or else you will hit the above error as well.  Fire up the command prompt as administrator in your DC and key the following: netdom /query fmso You must ensure that the DC holds the Schema Master FMSO role. 

Conclusion:

While people have argument to say that the AD schema extension can be done on site server. Base on my personal experience it would be best to do it on a DC with Schema Master FMSO role. Make sure you go through the above checkpoint so that you won't get the error. 

Happy reading!

SY 

Personal Ranting: AD Schema Extension (Part 2)

The first part of this series was written to out of "frustration" because of the confrontation of your potential customers. Knowing part one should adequately should adequately allow you to answer your customer's query.

Second part is more illustrate how to perform AD schema extension while the third part "Did you know" series what will you do when you hit issues. 

The steps are fairly simple:

Permission required:

"Schema Admins" & "Enterprise Admins" rights

Tool required: 

"extadsch.exe"

Steps:

• Create "System Management" folder under "System" container in ADSI edit. 

• Grant site server access to the above folder. (Add full control plus make sure the access is applied to "This object and all descendants objects" )

• Double click "extadsch.exe"

• Log will be created at the root of the hard disk. 

To ensure that these lists are current for your version of System Center 2012 Configuration Manager, review the ConfigMgr_ad_schema.LDF file that is located in the\SMSSETUP\BIN\x64 folder of the System Center 2012 Configuration Manager installation media.

Above are fairly simple steps but often face with violent opposition. But thing is just imagine that a spreadsheet (schema) has only ten columns and requires more columns (extend schema) to hold the information to make SCCM more useful, would you want to skip this step?

Happy reading!

SY

Personal Ranting: AD Schema Extension (Part 1)

Fear always stems from doubt and disbelief. If you can understand the underlying issues, you will not have a problem in implementing the technology to your environment. Over the years as a system engineer and consultant, you will be confronted by the customers why is there a need to perform AD schema extension before SCCM installation?

When you can understand the actual rationale behind of AD schema extension you will not reject the idea the next time you deploy SCCM. But nonetheless, AD schema extension is only performed once. So if you are using SCCM 2007 and upgrade to SCCM 2012, then you do not have to perform this action again. 

What is AD schema actually?

In a nutshell, AD schema is part of AD component where it keeps the data of all the AD objects. And these objects are term under class and attributes. 

What is an attribute?

Attributes contain data that defines the information that is stored in an object or in another attribute. For example, a user account object has attributes that store user information, such as the user’s first name, last name, password, office number, and telephone number. 

What is an class?

Object definitions are categorized into groups that are called classes. Classes act as blueprints that can be used each time a new object is created. When a new object is created in the directory, the object’s class determines the attributes that are associated with the new object, including which attributes are required and which attributes are optional.

The above information is taken from: 

https://technet.microsoft.com/en-sg/library/cc773309%28v=ws.10%29.aspx
  

https://technet.microsoft.com/en-sg/library/gg712272.aspx

A one time only AD schema extension will create 14 attributes and 4 classes in AD. (18 in total) 

Attributes: 

cn=mS-SMS-Assignment-Site-Code

cn=mS-SMS-Capabilities

cn=MS-SMS-Default-MP

cn=mS-SMS-Device-Management-Point

cn=mS-SMS-Health-State

cn=MS-SMS-MP-Address

cn=MS-SMS-MP-Name

cn=MS-SMS-Ranged-IP-High

cn=MS-SMS-Ranged-IP-Low

cn=MS-SMS-Roaming-Boundaries

cn=MS-SMS-Site-Boundaries

cn=MS-SMS-Site-Code

cn=mS-SMS-Source-Forest

cn=mS-SMS-Version

Classes: 

cn=MS-SMS-Management-Point

cn=MS-SMS-Roaming-Boundary-Range

cn=MS-SMS-Server-Locator-Point

cn=MS-SMS-Site

Happy reading!

SY