Skip to content
MitoMito Docs

AD-SCH-04: Schema version details should be retrievable
ID AD-SCH-04
Severity Info
Suite Active Directory (on-premises)
Product Active Directory
Feature Schema
Security area Infrastructure hardening
Resource type Tenant
Reads from On-premises Active Directory

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Comprehensive schema information provides the foundation for understanding your Active Directory infrastructure. The schema defines:

  • Object classes: What types of objects can exist (users, computers, groups)
  • Attributes: What properties objects can have
  • Constraints: Rules for object creation and modification

Understanding schema details helps with:

  • Troubleshooting: Identifying schema-related issues
  • Planning: Preparing for application deployments
  • Documentation: Maintaining accurate AD documentation
  • Security: Detecting unauthorized schema modifications

Control Type

Section titled “Control Type”

Operational

Security Recommendation

Section titled “Security Recommendation”

Protect your schema with these practices:

  • Schema Admins group: Keep membership minimal and monitored
  • Change control: Require approval for all schema modifications
  • Documentation: Maintain records of all schema extensions
  • Backup: Regularly backup the schema NC (naming context)
  • Monitoring: Alert on any schema modifications

How the Test Works

Section titled “How the Test Works”

This test retrieves detailed information from the schema container including:

  • Schema version number
  • Corresponding Windows Server version
  • Schema creation and modification dates
  • Distribution of object classes
  • Total schema object count
Section titled “Related Tests”
  • Test-MtAdSchemaVersionEntryCount - Shows schema version number
  • Test-MtAdSchemaModificationYearCount - Shows modification timeline
  • Test-MtAdSchemaModificationYearDetails - Detailed modification breakdown

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.