Active Directory Secure Schema Update (ADPREP) via Suspended Replication

von

Procedure for Performing a Safe Active Directory Schema Update

Many have likely performed an Active Directory schema update without fully understanding or considering the associated risks. I recently encountered my first power outage during a schema update. Fortunately, it happened in my private test environment. As a result, the schema became corrupted. However, because it had already replicated before the outage, restarting the servers left Active Directory completely broken, producing only error messages when trying to access objects.

To prevent this from happening again, I’ve compiled a guide that outlines the following procedure:

  1. Disable Active Directory replication on the schema master
  2. Run ADPREP
  3. Test access to Active Directory (Active Directory users and computers)
  4. Re-enable Active Directory replication
  5. Test Active Directory

This are the detailed steps for this procedure:

Finding the schema master

For this, I use the command „netdom query fsmo“ and check which DC is the schema master.

Determine the current schema version

For this, I use the DSQUERY command on the schema master.

Here’s an example for the domain DEMO.LOCAL:

dsquery * CN=Schema,CN=Configuration,DC=DEMO,DC=LOCAL -Scope Base -attr objectVersion

NOTICE: if it’s an Exchange schema update: I can use this command to retrieve the Exchange version of the schema:

dsquery * CN=ms-Exch-Schema-Version-Pt,cn=schema,cn=configuration,dc=DEMO,dc=INTERN -scope base -attr rangeUpper

Disable directory replication on the schema master

To do this, use the „repadmin“ command to disable inbound and outbound replication (SCHEMAMASTER-NAME must be adjusted):

repadmin /options SCHEMAMASTER-NAME +DISABLE_OUTBOUND_REPL
repadmin /options SCHEMAMASTER-NAME +DISABLE_INBOUND_REPL

Afterwards, you will find events 1113 and 1115 in the DIRECTORY SERVICE event log, indicating that inbound and outbound replication has been disabled by the user.

Perform Schema Update

Now we can do the secure schema update with this commands:

adprep /forestprep
adprep /domainprep
adprep /rodcprep

The schema updates are also logged in the event log.

Check schema version after update

You can now use the DSQUERY command to check if the new schema version is present:

dsquery * CN=Schema,CN=Configuration,DC=DEMO,DC=LOCAL -Scope Base -attr objectVersion

As a test, log in to a different domain controller and run the same command. You will see that the schema version is still the old version because replication is not active!

Test access to Active Directory on the schema master

Open several Active Directory consoles on the schema master that is currently being updated and check for error messages. If everything is OK, you can re-enable replication.

Re-enable replication and update the schema globally

Restart inbound and outbound replication on the schema master using the following commands:

repadmin /options SCHEMAMASTER-NAME -DISABLE_OUTBOUND_REPL
repadmin /options SCHEMAMASTER-NAME -DISABLE_INBOUND_REPL

The re-enabling of replication will also be recorded in the event log with events 1114 and 1116 in the DIRCTORY SERVICE log.

Check the new schema version

Start replication on the domain controllers manually or wait for the replication cycle to complete. Then, check on all existing domain controllers whether the schema has been applied using the previous DSQUERY command.

This allows you to perform a low-risk schema extension and minimizes the risk of damaging the Active Directory.

Schreibe einen Kommentar