Active Directory Objects and Schema Brief
What It Is
Every user, computer, group, printer, and Group Policy Object in Active Directory is stored as an object, and every object is an instance of an object class defined in the schema. The schema is the forest-wide rulebook: it says what classes of objects can exist and what attributes each class can or must carry. A user object, for example, must have sAMAccountName and can optionally hold attributes like mail, memberOf, or pwdLastSet.
Mental Model
Think of the schema as a database table definition that applies across an entire forest at once. If "user" is a table, the schema says which columns exist (attributes) and what type of data each column holds (syntax: text, number, timestamp, binary). Every actual user account is a row in that table, which is exactly what an object is. Replication keeps every domain controller's copy of those rows consistent. The global catalog is a separate, thin, read-only index covering a subset of attributes for every object in the whole forest, so a search does not need to know in advance which domain holds the answer.
Key Pieces
- Object: a single database entry (user, computer, group) with a unique distinguishedName, objectGUID, and attributes defined by its class
- Schema: the forest-wide blueprint defining every object class and attribute; changing it requires Schema Admin rights and affects every domain
- Object class: the schema definition specifying an object type's required and optional attributes
- Attribute: a single named property with a schema-defined syntax (string, integer, timestamp, binary) and single or multi-valued
- Global catalog: a partial, forest-wide index on designated domain controllers, holding only commonly-searched attributes
- Multi-master replication: every domain controller holds a full, writable copy of the directory and propagates changes to the others
Interview Phrasing
Active Directory stores everything (users, computers, groups) as objects, and every object is an instance of an object class defined by the schema. The schema is a forest-wide blueprint: it defines what classes of objects can exist and what attributes each class can hold, including each attribute's data type. Because the schema is forest-wide, a schema change made anywhere affects every domain in the forest, which is why schema modification is tightly restricted. The global catalog holds a partial set of attributes for every object across the forest so searches do not need to know in advance which domain an object lives in. Replication is the multi-master process that keeps every domain controller's copy of the directory synchronized.
Common Pitfalls
- Treating the schema as a per-domain setting: it is defined once for the entire forest and a change anywhere applies everywhere
- Confusing the global catalog with the whole directory: the GC only holds a subset of attributes, not the complete object
- Assuming one domain controller is the source of truth: AD uses multi-master replication, so any DC can accept a write
- Assuming attributes are all plain text: the schema assigns a strict syntax (string, integer, timestamp, binary) to every attribute
- Treating replication lag as a sign something is broken, when it is a normal and expected property of multi-master replication
Practice Prompts
- Explain the difference between an object's full attribute set and what the global catalog stores for that object
- Explain why a schema change requires forest-wide caution instead of being scoped to one domain
- Explain what happens when a domain has multiple domain controllers and which one holds the real copy of an object
- Explain replication lag to a stakeholder who is worried two domain controllers briefly showed different data
- Explain why querying a global catalog port (3268/3269) can return different results than querying a standard LDAP port (389/636)
