The structure of Active Directory -- the formatting of records, the type of information stored in it, etc. -- is referred to as its schema. Since AD is basically a database, the default schema is not set in stone and it can in fact be changed if needed. That said, extending the AD schema is not something you want to do trivially. The presence of third-party products that do this can complicate the issue, especially as far as security is concerned.
The first thing to be conscious of when using these products is that any additions to the schema are typically available by default in a read-only fashion to everyone. If you extend the schema, you also need to take into account what kind of access to grant to the new schema elements -- who gets to add or change these new elements, whether or not they can be seen by most users, etc.
Read More
No comments:
Post a Comment