当您为网域发起架构扩展时，托管式 Microsoft AD 会验证 LDIF 文件的结构、架构元素的格式以及支持的更改类型或操作。
如果 LDIF 文件有效，托管式 Microsoft AD 会先备份网域，然后再应用架构更改。如果您在更新架构后遇到应用出现任何问题，可以使用此备份来恢复该网域。然后，托管式 Microsoft AD 会将一个网域控制器从网域中隔离，并使用 Ldifde 工具应用架构更改。在架构更改进行期间，您网域中的其他域控制器会处理客户端流量。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-11。"],[],[],null,["# About schema extension\n\nThis page describes how schema extension works in Managed Service for Microsoft Active Directory.\n\nOverview\n--------\n\nActive Directory relies on schema to organize and store the directory data. The AD schema defines the object classes and its attributes that are used to store the directory data.\n\nYou can use schema extensions to perform schema changes and enable support for applications which are dependent on specific classes or attributes in Active Directory.\n\nYou can extend the default AD schema by defining new classes and attributes or modifying the definitions or properties of existing classes and attributes. Managed Microsoft AD lets you extend the schema using an LDAP Data Interchange Format (LDIF) file that contains commands for schema changes. For more information, see [Extending the Schema](https://docs.microsoft.com/en-us/windows/win32/ad/extending-the-schema?redirectedfrom=MSDN).\n\nFor more information about LDIF, see [LDAP Data Interchange Format](https://en.wikipedia.org/wiki/LDAP_Data_Interchange_Format).\n\nHow to prepare your LDIF file\n-----------------------------\n\nAn LDIF file is a standard plain text data interchange format for representing Lightweight Directory Access Protocol (LDAP) directory content and update requests. An LDIF file consists of a series of records that represents a collection of update requests, such as add, modify, rename. Blank lines separate the set of records in the LDIF file representing each entry of update request. We recommend you to understand the format of LDIF files before creating your file with schema changes. For more information, see [LDIF Scripts](https://docs.microsoft.com/en-us/windows/win32/ad/ldif-scripts?redirectedfrom=MSDN).\n\nBefore preparing your LDIF file, read the following guidelines.\n\n### Schema elements\n\nSchema elements, such as classes, attributes, objects, are the building blocks of an AD schema. We recommend you to learn the key concepts related to schema elements such as attributes, object classes, object identifiers, and linked attributes. For more information, see [Active Directory Schema (AD DS)](https://docs.microsoft.com/en-us/windows/win32/ad/active-directory-schema).\n\n### LDIF file structure\n\nYou need to arrange the entries in an LDIF file by using the [Directory Information Tree (DIT)](https://en.wikipedia.org/wiki/Directory_information_tree) structure. The structure of a valid LDIF file must adhere to the following guidelines:\n\n- List the parent entries before the child entries.\n- Separate the entries in an LDIF file with a blank line.\n- Any class or attribute that you use in an entry must exist in the schema. Before using a class or attribute, make sure you verify if it is available in the schema. If not, you need to add the class or attribute to the schema. For example, you need to create an attribute before attaching the attribute with a class.\n\n### Distinguished name format\n\nAll entries in an LDIF file begin with a distinguished name (DN). It specifies the AD object upon which the records operate on. In case the records update schema cache, DN must be empty. For schema changes, DN must be in the following format: \n\n```\ndn: cn=CLASS_OR_ATTRIBUTE,cn=Schema,cn=Configuration,dc=ROOT_DOMAIN,dc=TOP_LEVEL_DOMAIN\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eCLASS_OR_ATTRIBUTE\u003c/var\u003e: The name of a class or attribute. For example, `example-attribute`.\n- \u003cvar translate=\"no\"\u003eROOT_DOMAIN\u003c/var\u003e: The root domain of your domain name. For example, if your domain name is `example.com`, enter `example`.\n- \u003cvar translate=\"no\"\u003eTOP_LEVEL_DOMAIN\u003c/var\u003e: The top-level domain of your domain name. For example, if your domain name is `example.com`, enter `com`.\n\nFor example, the DN of an attribute `example-attribute` for domain name `example.com` must be in the following format: \n\n```\ndn: cn=example-attribute,cn=Schema,cn=Configuration,dc=example,dc=com\n```\n| **Note:** For schema extensions, Managed Microsoft AD only supports DNs with the following CN entries: `cn=Schema,cn=Configuration`.\n\n### Supported LDIF changetypes\n\nManaged Microsoft AD supports the following LDIF changetypes for schema extension:\n\n### Considerations\n\nBefore you extend the schema, make sure you refer to the following considerations.\n\n- Microsoft provides detailed advisories describing the impact of schema extensions on your Active Directory environment. Make sure you review them carefully before extending the schema. For more information, see [What You Must Know Before Extending the Schema](https://docs.microsoft.com/en-us/windows/win32/ad/what-you-must-know-before-extending-the-schema?redirectedfrom=MSDN).\n- Adding a class or attribute to the schema is permanent. However, you can disable a class or attribute that you no longer require after adding it. For more information, see [Disabling Existing Classes and Attributes](https://docs.microsoft.com/en-us/windows/win32/ad/disabling-existing-classes-and-attributes?redirectedfrom=MSDN).\n\nHow schema extension works\n--------------------------\n\nWhen you initiate schema extension for a domain, Managed Microsoft AD validates the LDIF file for structure, format of schema elements, and supported changetypes or actions.\n\nIf the LDIF file is valid, Managed Microsoft AD takes a backup of the domain before applying the schema changes. If you encounter any problems with your application after updating the schema, you can use this backup to restore the domain. Then, Managed Microsoft AD isolates one of your domain controllers from the domain and applies the schema changes using the [Ldifde tool](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11)). While schema changes are in progress, other domain controllers in your domain serve the client traffic.\n\nIf the schema changes succeed, then the isolated domain controller connects back to the domain and replicates these schema changes to other domain controllers in the domain.\n\nIf the schema changes fail, Managed Microsoft AD reverts the domain controller to the backed up state.\n\nManaged Microsoft AD doesn't support partial schema extension on a domain. In other words, if any of the commands in the LDIF file fails to apply on the domain, the schema extension request fails. Managed Microsoft AD also reverts your domain back to the state it was prior to applying the schema changes.\n| **Note:** If you have your domain deployed in only one region when the schema extension is in progress, then only one domain controller serves your client traffic. For high availability, we recommend that you deploy your domain in at least two regions before you extend the schema.\n\nWhat's next\n-----------\n\n- Learn how to [extend schema](/managed-microsoft-ad/docs/extend-schema) in Managed Microsoft AD.\n- [Restrictions on Schema Extension](https://docs.microsoft.com/en-us/windows/win32/ad/restrictions-on-schema-extension?redirectedfrom=MSDN)"]]
