Windows Security Monitoring

CHAPTER 8Active Directory Objects

The Microsoft Active Directory database contains a variety of predefined object classes, such as user, computer, contact, and so on. It also contains attribute objects, which can be used in classes.

An Active Directory class, defined as a classSchema type object, defines attributes for specific class, default values for those attributes, and security settings. For example, the user class is defined as a classSchema object type.

An Active Directory attribute, defined as an attributeSchema type object, defines settings for a specific attribute that then can be used in multiple classes. For example, the cn attribute is defined as an attributeSchema object type.

All classSchema and attributeSchema objects are stored in the special Active Directory partition, called the schema partition. You can view all schema partition objects using, for example, the adsiedit.msc tool. Figure 8-1 shows an example of the schema partition view in adsiedit.msc.

Figure 8-1: Active Directory schema partition view in adsiedit.msc

All classSchema and attributeSchema objects have a unique Globally Unique Identifier (GUID) attribute named schemaIDGUID. Many Windows mechanisms, including the Windows auditing subsystem, use these GUIDs to refer to a specific class or attribute. Schema GUIDs for default Active Directory classes and attributes have predefined values and ...