스키마 확장을 시작하면 관리형 Microsoft AD가 스키마 변경사항을 적용하기 전에 자동으로 스키마 확장 백업을 만듭니다. 스키마 확장 후 문제가 발생하면 이 백업을 사용하여 도메인을 복원할 수 있습니다. 스키마 확장 백업을 식별하기 위해 도메인에 생성된 백업을 나열할 수 있습니다.
OPERATION_ID를 스키마 확장의 작업 ID로 바꿉니다. 예를 들면 operation-1234567890-98765a1b2c3d4e5-e6f7g8-9h0i1j2입니다.
스키마 확장 확인
관리형 Microsoft AD 인스턴스의 스키마를 확장한 후 애플리케이션을 Active Directory와 통합하기 전에 스키마 변경사항을 확인해야 합니다. 다양한 도구와 접근 방식을 사용하여 스키마 변경사항을 확인할 수 있습니다. 다음 섹션에서는 이러한 접근 방식 중 하나를 사용하여 스키마 변경사항을 확인하는 방법을 설명합니다.
Active Directory Schema Snap-In
Windows PowerShell
Active Directory Schema Snap-In
Active Directory Schema Snap-In을 사용하여 스키마 변경사항을 확인하려면 다음을 수행합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2024-12-21(UTC)"],[],[],null,["# Extend schema\n\nThis document explains how to extend the schema in a Managed Service for Microsoft Active Directory instance.\n\nBefore you begin\n----------------\n\nBefore you begin, do the following:\n\n1. [Create a Managed Microsoft AD domain](/managed-microsoft-ad/docs/create-domain).\n2. [Create and join a Windows VM to the domain](/managed-microsoft-ad/docs/quickstart-domain-join-windows).\n3. Make sure that you read [About schema extension](/managed-microsoft-ad/docs/schema-extension) and understand these [considerations](/managed-microsoft-ad/docs/schema-extension#considerations).\n4. Prepare the LDIF file with the schema changes. For more information, see [How to prepare your LDIF file](/managed-microsoft-ad/docs/schema-extension#prepare-ldif).\n5. Make sure that you have any one of the following Identity and Access Management (IAM) user roles:\n\n - Google Cloud Managed Identities Domain Admin (`roles/managedidentities.domainAdmin`)\n - Google Cloud Managed Identities Admin (`roles/managedidentities.admin`)\n\n For more information, see [Cloud Managed Identities roles](/iam/docs/understanding-roles#cloud-managed-identities-roles).\n\nExtend the schema\n-----------------\n\nWhen you initiate schema extension, Managed Microsoft AD creates a [schema extension backup](/managed-microsoft-ad/docs/backup-restore#overview) automatically before applying the schema changes. You can use this backup to [restore the domain](/managed-microsoft-ad/docs/backup-restore#restore-backup) if you encounter any problems after schema extension. To identify the schema extension backup, you can [list the backups](/managed-microsoft-ad/docs/backup-restore#list-backup) created for your domain.\n\nTo extend the schema, run the following gcloud CLI command: \n\n```\ngcloud active-directory domains extend-schema DOMAIN_NAME --ldif-file=LDIF_FILE_PATH \\\n --description=SCHEMA_EXTENSION_DESCRIPTION --project=DOMAIN_RESOURCE_PROJECT_ID --async\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eDOMAIN_NAME\u003c/var\u003e: The name of your Managed Microsoft AD domain. For example, `my-domain.example.com`.\n- \u003cvar translate=\"no\"\u003eLDIF_FILE_PATH\u003c/var\u003e: The path of the LDIF file with the schema changes. The maximum file size is limited to 1 MB.\n- \u003cvar translate=\"no\"\u003eSCHEMA_EXTENSION_DESCRIPTION\u003c/var\u003e: The description of the schema changes.\n- \u003cvar translate=\"no\"\u003eDOMAIN_RESOURCE_PROJECT_ID\u003c/var\u003e: The project ID of the domain resource project. For example, `my-project`.\n\nManaged Microsoft AD initiates schema extension and responds with an operation ID which you can use to track the completion of schema extension.\n\nTo check the status of your schema extension, run the following gcloud CLI command: \n\n```\ngcloud active-directory operations describe OPERATION_ID\n```\n\nReplace \u003cvar translate=\"no\"\u003eOPERATION_ID\u003c/var\u003e with the operation ID of your schema extension. For example, `operation-1234567890-98765a1b2c3d4e5-e6f7g8-9h0i1j2`.\n\nVerify the schema extension\n---------------------------\n\nAfter you extend the schema of your Managed Microsoft AD instance, it's important you verify the schema changes before integrating your applications with Active Directory. You can verify the schema changes using different tools and approaches. In the following sections, we explain how you can verify the schema changes using any one of these approaches:\n\n1. Active Directory Schema Snap-In\n2. Windows PowerShell\n\n### Active Directory Schema Snap-In\n\nTo verify the schema changes using Active Directory Schema Snap-In, do the following:\n\n1. Login to your domain-joined VM as a delegated administrator.\n2. [Install the **Active Directory Schema Snap-In**](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc732110(v=ws.11)?redirectedfrom=MSDN).\n3. Open the **Microsoft Management Console (MMC)**.\n4. Expand the **Active Directory Schema** tree for your directory.\n5. Verify if you can see the changes in classes and attributes of the schema.\n\n### Windows PowerShell\n\nTo verify the schema changes using Windows PowerShell, use `Get-ADObject` cmdlet. Run the following command in Windows PowerShell: \n\n```\nget-adobject -Identity 'cn=ATTRIBUTE,cn=Schema,cn=Configuration,dc=ROOT_DOMAIN,dc=TOP_LEVEL_DOMAIN' -Properties *\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eATTRIBUTE\u003c/var\u003e: The name of an attribute in your schema. For example, `example-attribute`.\n- \u003cvar translate=\"no\"\u003eROOT_DOMAIN\u003c/var\u003e: The root domain of your domain name. For example, if your domain name is `example.com`, enter `example`.\n- \u003cvar translate=\"no\"\u003eTOP_LEVEL_DOMAIN\u003c/var\u003e: The top-level domain of your domain name. For example, if your domain name is `example.com`, enter `com`.\n\nIn the response, verify if you can see the changes in classes and attributes of the schema.\n\nWhat's next\n-----------\n\n- [Back up and restore a domain](/managed-microsoft-ad/docs/backup-restore)"]]
