Windows Server 2003 R2 extended the Windows Server 2003 schema from schema version 30 to 31. The update from 30 to 31 was schema file sch31.ldf which included support for DFS Replication (DFSr). An upgrade from Windows Server 2003 to Windows Server 2008 schema transitions the schema to schema version 44. This includes sch32.ldf through sch44.ldf.
If an upgrade is performed from a domain that is currently schema version 30, the Windows Server 2008 ADPREP /forestprep command will include sch31.ldf in the schema update process.
Note: Windows Server 2008 R2 transitions the Active Directory Schema to schema version 47.
The updates to the Active Directory schema are:
Sch32.ldf
This adds new attributes of:
After the addition of these attributes, Sch32.ldf then modifies the systemMayContain values of certain objects that may contain any or all of these new attributes.
The schema version is then increased to schema version 32.
Sch33.ldf
After the addition of these attributes, Sch33.ldf then modifies the msDS-Never-Reveal-Group and the msDS-Reveal-OnDemand-Group attributes and marks them as multi-valued. It then modifies the systemMayContain values of certain objects that may contain any or all of these new attributes.
The schema version is then increased to schema version 33.
Sch34.ldf
Sch34.ldf adds the following attributes to the Schema:
Sch34.ldf then adds the following classes to the Active Directory Schema:
After the addition of these attributes and classes, Sch34.ldf then modifies the systemMayContain values of certain objects that may contain any or all of these new attributes.
The schema version is then increased to schema version 34.
Sch35.ldf
Sch35.ldf adds the following attributes to the Schema:
After the addition of these attributes, Sch35.ldf then modifies the systemMayContain values of the object CN=User,CN=Schema,CN=Configuration,DC=X (where DC=x is the Distinguished Name of the forest root domain) to include these new attributes.
The schema version is then increased to schema version 35.
Sch36.ldf
Then Sch36.ldf makes the following addition to the Schema:
After the addition of this one attribute, Sch36.ldf modifies the Search Flags value of the following attributes:
The schema version is then increased to schema version 36.
Sch37.ldf
The LDF file Sch37.ldf modifies adds the following attributes to the schema:
After these attributes have been added, Sch37.ldf modifies security on Terminal Services objects and then updates the mayContain values of Terminal Services and DFSr objects.
The schema version is then increased to schema version 37.
Sch38.ldf
Sch38.ldf only makes one change. This change is to the CN=ms-DS-AuthenticatedAt-DC,CN=Schema,CN=Configuration,DC=X attribute. The modification that is made to this attribute is to mark this attribute as systemOnly.
After this change, the schema version is still increased to version 38.
Sch39.ldf
Sch39.ldf begins by modifying the following attributes:
Sch39.ldf then modifies the adminDescription, searchFlags, and rangeUppper of the attributes:
Lastly, Sch39.ldf also updates the systemMayContain and mayContain values of additional objects in the Schema which could contain any of these attributes.
The schema version is then increased to schema version 39.
Sch40.ldf
The LDF file Sch40.ldf adds many attributes to the schema. Half of these attributes are used with Fine Grained Password policies and the other half are used with Terminal Server Licensing. This list is all of the attributes that are added to the Active Directory schema:
It is important to note that these password policy related attributes (i.e. msDS-LockoutDuration, msDS-LockoutThreshold, msDS-MinimumPasswordAge, etc.) are not simply an update to the existing Lockout Duration, Lockout Threshold, Minimum Password Age, etc. settings that administrators are used to see in a Password Policy. Password Policy settings on a Windows 2000 and Windows Server 2003 domain controller are contained in the registry of the domain controller, not as attributes held within Active Directory.
Windows Server 2008 in Domain Functional Level 2008 allows for multiple Fine Grained Password Policies per domain. For this to exist, attributes that correspond to each setting needed to be introduced to the schema.
Sch40.ldf then modifies attributes that have been created during the schema update and also updates various objects in the schema. These modifications are searchFlags, mayContain, systemMayContain, and possPosition values.
After these changes, sch40.ldf then creates two new classes that pertain to Fine Grained Password Policies. These classes are:
After the classes are created, the sch40.ldf file then modifies more systemMayContain values of other objects.
The schema version is then increased to schema version 40.
Sch41.ldf
Sch41.ldf makes only a few changes to objects that exist in the schema. First, modifications are made to the systemMayContain values of the objects:
Second, modifications are made to the rightsGUID values of the objects:
The schema version is then increased to schema version 41.
Sch42.ldf
Schema update 42 makes modifications to over 360 objects in the schema. The modifications that are made to these objects are adding the schemaFlagsEx attribute to each object and setting a value of 1. The code for each modification looks like this:
changetype: ntdsSchemaModify
add: schemaFlagsEx
schemaFlagsEx: 1
Only the operating system can modify the SchemaFlagsEX value and this value specifies whether an attribute can be part of the filtered attribute set.
After the update to all 360+ attributes, the schema version is increased to schema version 42.
Sch43.ldf
Sch43.ldf adds the following attributes to the Active Directory Schema:
Once these attributes have been created the schema version is incremented to schema version 43.
Sch44.ldf
Schema Update 44 only does modifications to some objects that already exist. These modifications are changing systemMayContain, showInAdvancedViewOnly, searchFlags, and adminDescription. Once this is complete, the schema version is incremented to schema version 44. At this point, the Windows Server 2008 ADPREP /forestprep is complete
Additional LDF files for Windows Server 2008 R2 ADPREP /forestprep
Sch45.ldf
Sch45.ldf adds the following attributes to the Active Directory schema:
Then, modifications are made to various objects in the schema which contain values such as systemMayContain and appliesTo. Lastly, the objects CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=X and CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=X are created as optional features that can be enabled with Windows Server 2008 R2.
When this is complete the schema version is incremented to 45.
Sch46.ldf
The LDF file Sch46.ldf makes one change to the object CN=ms-DS-Managed-Service-Account,CN=Schema,CN=Configuration,DC=X. The change that is made is to modify the defaultHidingValue and configure it with a value of FALSE.
When this is complete the schema version is incremented to 46.
Sch47.ldf
Sch47.ldf modifies only two objects in the schema. These objects are CN=NTDS-DSA,CN=Schema,CN=Configuration,DC=X and CN=ms-DS-Managed-Service-Account,CN=Schema,CN=Configuration,DC=X. The modification to the first is a modification to the systemMayContain value. The modification to the second object is a deletion of the systemPossSuperiors value.
When this is complete the schema version is incremented to schema version 47 and the ADPREP /forestprep for Windows Server 2008 R2 is complete.