Active Directory Schema Reports

The Active Directory Schema contains essential and mission-critical Active Directory object and attribute class definitions and structural rules. The need to have insight into the state and security of the Schema is thus vital to security, and Schema Reports provide organizations this vital insight.

ACTIVE DIRECTORY SCHEMA MANAGEMENT REPORTS

The following is a list of the Top-5 Active Directory Schema Reports that are vital for security and generally required for security auditing and to demonstrate regulatory compliance –

I. Security State Reports –

   The following Schema reports provide insight into the security state of the Schema –

1. All recently introduced Active Directory Schema classes (i.e. recent Schema extensions)
2. All recently introduced Active Directory Schema attributes (i.e. recent Schema extensions)
3. All disabled (deactivated) Active Directory Schema classes
4. All disabled (deactivated) Active Directory Schema attributes
5. All multi-valued Active Directory Schema attributes

II. Delegated Administrative Access Reports –

   The management of the Schema is a highly-sensitive and mission-critical operation and thus
   authority to perform Active Directory Schema Management tasks must never be delegated.

How to Generate these Group Reports:

   Organizations generally have two predominant reporting options to fulfill their AD reporting needs,
   and most prefer to use reporting tools, especially to fulfill their delegated access reporting needs.

   The Microsoft-endorsed Gold Finger Active Directory reporting tool can also generate these reports.