當您為網域啟動結構定義擴充功能時，受管理的 Microsoft AD 會驗證 LDIF 檔案的結構、結構定義元素的格式，以及支援的變更類型或動作。
如果 LDIF 檔案有效，Managed Microsoft AD 會先備份網域，再套用結構定義變更。如果在更新結構定義後遇到任何應用程式問題，您可以使用這個備份來還原網域。然後，受管理的 Microsoft AD 會將網域中的其中一個網域控制站隔離，並使用 Ldifde 工具套用結構定義變更。在結構定義變更期間，網域中的其他網域控制器會為用戶端流量提供服務。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# About schema extension\n\nThis page describes how schema extension works in Managed Service for Microsoft Active Directory.\n\nOverview\n--------\n\nActive Directory relies on schema to organize and store the directory data. The AD schema defines the object classes and its attributes that are used to store the directory data.\n\nYou can use schema extensions to perform schema changes and enable support for applications which are dependent on specific classes or attributes in Active Directory.\n\nYou can extend the default AD schema by defining new classes and attributes or modifying the definitions or properties of existing classes and attributes. Managed Microsoft AD lets you extend the schema using an LDAP Data Interchange Format (LDIF) file that contains commands for schema changes. For more information, see [Extending the Schema](https://docs.microsoft.com/en-us/windows/win32/ad/extending-the-schema?redirectedfrom=MSDN).\n\nFor more information about LDIF, see [LDAP Data Interchange Format](https://en.wikipedia.org/wiki/LDAP_Data_Interchange_Format).\n\nHow to prepare your LDIF file\n-----------------------------\n\nAn LDIF file is a standard plain text data interchange format for representing Lightweight Directory Access Protocol (LDAP) directory content and update requests. An LDIF file consists of a series of records that represents a collection of update requests, such as add, modify, rename. Blank lines separate the set of records in the LDIF file representing each entry of update request. We recommend you to understand the format of LDIF files before creating your file with schema changes. For more information, see [LDIF Scripts](https://docs.microsoft.com/en-us/windows/win32/ad/ldif-scripts?redirectedfrom=MSDN).\n\nBefore preparing your LDIF file, read the following guidelines.\n\n### Schema elements\n\nSchema elements, such as classes, attributes, objects, are the building blocks of an AD schema. We recommend you to learn the key concepts related to schema elements such as attributes, object classes, object identifiers, and linked attributes. For more information, see [Active Directory Schema (AD DS)](https://docs.microsoft.com/en-us/windows/win32/ad/active-directory-schema).\n\n### LDIF file structure\n\nYou need to arrange the entries in an LDIF file by using the [Directory Information Tree (DIT)](https://en.wikipedia.org/wiki/Directory_information_tree) structure. The structure of a valid LDIF file must adhere to the following guidelines:\n\n- List the parent entries before the child entries.\n- Separate the entries in an LDIF file with a blank line.\n- Any class or attribute that you use in an entry must exist in the schema. Before using a class or attribute, make sure you verify if it is available in the schema. If not, you need to add the class or attribute to the schema. For example, you need to create an attribute before attaching the attribute with a class.\n\n### Distinguished name format\n\nAll entries in an LDIF file begin with a distinguished name (DN). It specifies the AD object upon which the records operate on. In case the records update schema cache, DN must be empty. For schema changes, DN must be in the following format: \n\n```\ndn: cn=CLASS_OR_ATTRIBUTE,cn=Schema,cn=Configuration,dc=ROOT_DOMAIN,dc=TOP_LEVEL_DOMAIN\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eCLASS_OR_ATTRIBUTE\u003c/var\u003e: The name of a class or attribute. For example, `example-attribute`.\n- \u003cvar translate=\"no\"\u003eROOT_DOMAIN\u003c/var\u003e: The root domain of your domain name. For example, if your domain name is `example.com`, enter `example`.\n- \u003cvar translate=\"no\"\u003eTOP_LEVEL_DOMAIN\u003c/var\u003e: The top-level domain of your domain name. For example, if your domain name is `example.com`, enter `com`.\n\nFor example, the DN of an attribute `example-attribute` for domain name `example.com` must be in the following format: \n\n```\ndn: cn=example-attribute,cn=Schema,cn=Configuration,dc=example,dc=com\n```\n| **Note:** For schema extensions, Managed Microsoft AD only supports DNs with the following CN entries: `cn=Schema,cn=Configuration`.\n\n### Supported LDIF changetypes\n\nManaged Microsoft AD supports the following LDIF changetypes for schema extension:\n\n### Considerations\n\nBefore you extend the schema, make sure you refer to the following considerations.\n\n- Microsoft provides detailed advisories describing the impact of schema extensions on your Active Directory environment. Make sure you review them carefully before extending the schema. For more information, see [What You Must Know Before Extending the Schema](https://docs.microsoft.com/en-us/windows/win32/ad/what-you-must-know-before-extending-the-schema?redirectedfrom=MSDN).\n- Adding a class or attribute to the schema is permanent. However, you can disable a class or attribute that you no longer require after adding it. For more information, see [Disabling Existing Classes and Attributes](https://docs.microsoft.com/en-us/windows/win32/ad/disabling-existing-classes-and-attributes?redirectedfrom=MSDN).\n\nHow schema extension works\n--------------------------\n\nWhen you initiate schema extension for a domain, Managed Microsoft AD validates the LDIF file for structure, format of schema elements, and supported changetypes or actions.\n\nIf the LDIF file is valid, Managed Microsoft AD takes a backup of the domain before applying the schema changes. If you encounter any problems with your application after updating the schema, you can use this backup to restore the domain. Then, Managed Microsoft AD isolates one of your domain controllers from the domain and applies the schema changes using the [Ldifde tool](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11)). While schema changes are in progress, other domain controllers in your domain serve the client traffic.\n\nIf the schema changes succeed, then the isolated domain controller connects back to the domain and replicates these schema changes to other domain controllers in the domain.\n\nIf the schema changes fail, Managed Microsoft AD reverts the domain controller to the backed up state.\n\nManaged Microsoft AD doesn't support partial schema extension on a domain. In other words, if any of the commands in the LDIF file fails to apply on the domain, the schema extension request fails. Managed Microsoft AD also reverts your domain back to the state it was prior to applying the schema changes.\n| **Note:** If you have your domain deployed in only one region when the schema extension is in progress, then only one domain controller serves your client traffic. For high availability, we recommend that you deploy your domain in at least two regions before you extend the schema.\n\nWhat's next\n-----------\n\n- Learn how to [extend schema](/managed-microsoft-ad/docs/extend-schema) in Managed Microsoft AD.\n- [Restrictions on Schema Extension](https://docs.microsoft.com/en-us/windows/win32/ad/restrictions-on-schema-extension?redirectedfrom=MSDN)"]]
