Active Directory security concerns

The first thing to be conscious of when using these products is that any additions to the schema are typically available by default in a read-only fashion to everyone. If you extend the schema, you also need to take into account what kind of access to grant to the new schema elements -- who gets to add or change these new elements, whether or not they can be seen by most users, etc.

For more information Create usable boundaries within AD Active Directory admin tips

Likewise, if you're extending the schema to work with a custom or third-party application (or if the app itself is making the changes), you should regard those changes as a possible security hole unless they are explicitly dealt with by the app itself or by work you do.

Also, schema changes cannot be undone without rolling back the AD store as a whole. You can modify or deactivate a given class or attribute, but changes cannot be deleted completely. If you can spare the time and resources, set up an isolated test forest (perhaps via Microsoft Virtual Server) where you can try out the results of your schema extensions in a controlled way. If the extensions you're considering are pretty major or may have an impact on the way AD is routinely accessed and changed, it will absolutely be worth the time and effort.

About the author: Serdar Yegulalp is editor of the Windows Power Users Newsletter. Check it out for the latest advice and musings on the world of Windows network administrators -- and please share your thoughts as well!