How to create custom attribute in Active Directory?

Question

Hi, We have two domains: domain A and domain B. We have created a few custom attributes in domain A and want the same custom attributes in domain B. Can you please tell us how we can create? Thanks!

Answer 1

Hello Khushi kumari, Thank you for posting in Q&A forum. Are domain A and domain B in the same forest? If you update the schema in domain A to add custom attributes within the same forest, these attributes will be available throughout the entire forest, including domain B. To use the same custom properties in domains in different forests, you need to extend the Active Directory schema in each domain. This can be achieved by using the ldifde tool. Regarding how to use the ldifde tool, I will attach relevant articles below for your reference, but I do not recommend personnel who are not familiar with AD to carry out architecture related operations. In domain A, you need to find the schema definitions for these custom attributes and export them to an LDIF (LDAP Data Interchange Format) file. In the generated LDIF file, you need to navigate to the section that contains your custom attribute definition and remove domain specific OIDs (object identifiers) and any other non generic attributes. In domain B, you will need to use the ldifde tool to import the modified LDIF file to extend the schema. After the operation is completed, you can use the repadmin tool to verify that the changes have been successfully synchronized. Conduct testing to ensure that custom attributes work as expected. Note: Before making changes to the Active Directory schema, please ensure that you have a complete backup. Due to the high permission requirements for architecture operations and the potential impact of changes on the entire AD environment, it is recommended to have experienced professionals familiar with AD perform the operations and avoid peak usage hours. Import or export directory objects using ldifde https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc758935(v=ws.10) https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc731033(v=ws.11) I hope the information above is helpful. If you have any questions or concerns, please feel free to let us know.

Best Regards, Daisy Zhou

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 2

Hi @Khushi kumari

If you want add custom attribute , you have to extend schema as mentioned in Microsoft articles below:

Extending the Active Directory Schema How to extend the schema

---

Pleasr don't forget to accept helpful answer

Answer 3

Have a look at an example to add an attribute here: https://mariusene.com/2024/01/19/active-directory-schema-extension-example/ Note that you will need to know which is the class you want to inherit from. Make sure you know what you are doing because once you create the new class you cannot delete it. Also I would suggest doing it first in a test environment.