In this post, I will show you how to create system management container. I will also cover the steps to extend the active directory schema (AD Schema) for SCCM.
This post can be considered as part 2 for deploying SCCM in our lab setup. In the first part I covered the steps to install active directory.
When you want to install SCCM, you have to prepare Active Directory for site publishing. This involves multiple steps which are listed in this post.
Note – If your Active Directory schema was extended for SCCM 2007 or Configuration Manager 2012, then you don’t need to do it again. The schema extensions are unchanged and will already be in place. Extending the schema is a one-time action for any forest.
Table of Contents
Prepare Active Directory for site publishing
Before you create system management container and extend the Active Directory schema for SCCM, here are some important prerequisites.
- There are no new Active Directory schema extensions for Configuration Manager current branch. If you previously extended the schema an earlier version, you don’t have to extend the schema again.
- When you extend the active directory schema for Configuration Manager, it is a forest-wide, one-time, irreversible action.
- To extend the AD schema, you must use an account that is a member of the Schema Admins group.
- You can extend the schema before or after you install a Configuration Manager site. However, it’s best to extend the schema before you start to configure your sites and hierarchy settings.
- After you extend the schema, the Active Directory global catalog replicates throughout the forest.
Create System Management Container
After we have a domain controller in our setup, the next step is to create a container. You create system management container one time in each domain that has a primary or secondary site. This will be used to publish data to Active Directory.
To Create System Management Container
- Login to domain controller with a domain admin account.
- Click Start , All Programs, Administrative Tools.
- Select ADSI Edit.
- Right click ADSI Edit and Click Connect to.
- The naming context should be Default naming context. Click OK.
- In the ADSI edit Console, Expand the Default Naming Context.
- Right click CN=System, Click New and create an Object.
- Select Container from the options. Click Next.
- Provide the object value as System Management.
- Click Next and refresh the ADSI edit to see the system management container in the console.
Delegate Permissions on System Management Container
Now that we have created the System Management Container, the next step is to delegate the permissions on System Management Container.
- Open the Active Directory Users and Computers.
- Click View and select Advanced Features.
- Right click System Management and delegate control.
- On the next screen click Add.
- In the Object Types select computers and click OK.
- Type the SCCM Server name and click Check Names.
- Select the SCCM computer from the list.
- In the Tasks to Delegate window, select Create a Custom task to delegate.
- Select the default option This folder, exiting objects in this folder and creation of new objects in this folder. Click Next.
- Select all the three permissions and click on full control.
- Click Finish to close the delegation wizard.
The following video tutorial explains the creation of system management container for SCCM.
Extend Active Directory Schema for SCCM
Coming to the last step which is extend Active Directory Schema for Configuration Manager. You can perform the below steps either on Active Directory or any member server. To extend AD schema, always use an account that is a member of the Schema Admins security group.
To Extend Active Directory Schema
- Mount the SCCM ISO file.
- Locate the folder : SMSSETUP\BIN\X64
- Right click file named “extadsch“. Hold the shift key+right-click on the file and copy as path.
- Open the command prompt and paste the copied data.
- That’s how you extend AD schema.
The log file extadsch.log is located in root drive i.e. C:\extadsch.log. Open it with a CMTrace log viewer. The highlighted text shows that Active Directory Schema has been extended successfully.
Modifying Active Directory Schema – with SMS extensions.
Defined attribute cn=MS-SMS-Site-Code.
Defined attribute cn=mS-SMS-Assignment-Site-Code.
Defined attribute cn=MS-SMS-Site-Boundaries.
Defined attribute cn=MS-SMS-Roaming-Boundaries.
Defined attribute cn=MS-SMS-Default-MP.
Defined attribute cn=mS-SMS-Device-Management-Point.
Defined attribute cn=MS-SMS-MP-Name.
Defined attribute cn=MS-SMS-MP-Address.
Defined attribute cn=mS-SMS-Health-State.
Defined attribute cn=mS-SMS-Source-Forest.
Defined attribute cn=MS-SMS-Ranged-IP-Low.
Defined attribute cn=MS-SMS-Ranged-IP-High.
Defined attribute cn=mS-SMS-Version.
Defined attribute cn=mS-SMS-Capabilities.
Defined class cn=MS-SMS-Management-Point.
Defined class cn=MS-SMS-Server-Locator-Point.
Defined class cn=MS-SMS-Site.
Defined class cn=MS-SMS-Roaming-Boundary-Range.
Successfully extended the Active Directory schema.
Please refer to the ConfigMgr documentation for instructions on the manual configuration of access rights in active directory which may still need to be performed. (Although the AD schema has now be extended, AD must be configured to allow each ConfigMgr Site security rights to publish in each of their domains.)
List of Active Directory Attributes and Classes
After you extend the schema for Configuration Manager, the following classes and attributes are added to the schema. These are available to all SCCM sites in that Active Directory forest.
|Active Directory Attributes||Active Directory Classes|