Mastering Active Directory

Schema operations master

This role boundary is the forest. This means that an Active Directory forest can have only one schema master. The owner of this role is the only domain controller in the forest who can update the Active Directory schema. In order to make schema changes in the forest, it also needs to have a user account that is a member of the Schema Admins group. Once the schema changes are done from the schema master role owner, they will be replicated to other domain controllers in the forest.

In an Active Directory forest, the schema master role owner can be found using the following command:

Get-ADForest | select SchemaMaster

When you add a new version of Active Directory to the domain the first time, it will need a schema ...