Create System Management Container, Extend AD Schema

In this post I will show you how to create system management container. I will also cover the steps to extend the active directory schema. This post can be considered as part 2 wrt deploying SCCM in our lab setup. In the first part I covered the steps to install active directory.

When you want to install SCCM, you have to prepare Active Directory for site publishing. This involves multiple steps which are listed in this post.

Note – If your Active Directory schema was extended for SCCM 2007 or Configuration Manager 2012, then you don’t need to do it again. The schema extensions are unchanged and will already be in place. Extending the schema is a one-time action for any forest.

Create System Management Container

After we have a domain controller in our setup, the next step is to create a container. You create system management container one time in each domain that has a primary or secondary site. This will be used to publish data to Active Directory.

To create system management container

  • Login to domain controller with a domain admin account.
  • Click Start , All Programs, Administrative Tools.
  • Select ADSI Edit.
  • Right click ADSI Edit and Click Connect to.
  • The naming context should be Default naming context. Click OK.
  • In the ADSI edit Console, Expand the Default Naming Context.
  • Right click CN=System, Click New and create an Object.
  • Select Container from the options. Click Next.
  • Provide the object value as System Management.
  • Click Next and refresh the ADSI edit to see the system management container in the console.

Create System Management Container

Delegate Permissions

Now that we have created the System Management Container, the next step is to delegate the permissions on System Management Container.

  • Open the Active Directory Users and Computers.
  • Click View and select Advanced Features.
  • Right click System Management and delegate control.
  • On the next screen click Add.
  • In the Object Types select computers and click OK.
  • Type the SCCM Server name and click Check Names.
  • Select the SCCM computer from the list.
  • In the Tasks to Delegate window, select Create a Custom task to delegate.
  • Select the default option This folder, exiting objects in this folder and creation of new objects in this folder. Click Next.
  • Select all the three permissions and click on full control.
  • Click Finish to close the delegation wizard.

Delegate Permissions on Container

Extend Active Directory Schema

Coming to the last step which is extend Active Directory Schema for Configuration Manager. You can perform the below steps either on Active Directory or any member server. To extend AD schema, always use an account that is a member of the Schema Admins security group.

To extend Active Directory Schema

  • Mount the SCCM ISO file.
  • Locate the folder : SMSSETUP\BIN\X64
  • Right click file named extadsch. Hold the shift key+right click on the file and copy as path.
  • Open the command prompt and paste the copied data.
  • That’s how you extend AD schema.

The log file extadsch.log is located in root drive i.e. C:\extadsch.log. Open it with a CMTrace log viewer. The highlighted text shows that Active Directory Schema has been extended successfully.

Extend Active Directory Schema

Related Posts
Oldest Most Voted
Inline Feedbacks
View all comments
Stuart McColgan

Thanks Praj, was very helpful.Hope all’s well 🙂

Vagner Oliveira

Hello Prajal,
is it possible to configure the container in another Active Directory folder, other than the System folder? Is it supported by SCCM?



Thank you for the above guidance. My question centers around changing the System Container Object. We currently have a test bed for SCCM, but we are looking to deploy into production. This will be a new server build, with proper (best practice) physical resources provided. What is the recommended practice for point our current extended AD infrastructure to this server?


why do we extend schema in sccm?

What is the uses of Extending AD_Schema?


why do we extend schema in sccm?
what is the uses of Extending AD _Schema?


Hello Prajwal

Our company has recently acquired another company. We have a two way
trust established between our forests. I plan to deploy a Distribution
point to the new forest for software deployments and imaging, but
maintain only one Management Point in the original forest.

How can I tell if the schema in our forest was extended when SCCM 2012 was deployed (before my time?)

Does the schema need to be extended in the new forest? If so how would
that be done without disrupting our current forest, as there is an
active two way trust?


Hello Prajwal,
You only need to put the Site Server inside the container right?
If you have Site System Server (like Distribution Points) you don’t have to add them inside the container right?

Richard Freck

I have been handed the reigns of the SCCM project at a school district. We currently have SCCM 2012 SP1 being utilized to the best of its ability from people prior to me. We have had Microsoft Premier out assisting us with a side by side install of SCCM 2012 R2 on a completely different VLAN from the existing. My question is am I able to have 2 site servers with full permissions to the Systems Management Container? The only errors we have in the R2 upgrade are in regards to creating objects in AD which of course isn’t going… Read more »

Prajwal Desai

Yes that should be possible. I haven’t tried that anytime but it can be done.


thank you
i want to ask if i extend the schema before with sccm 2007
what happen to extend the schema with 2012 and if i can remove the effect of 2007

Claude Richer

Hi Prajwal,
I have face this situation : When I ran the extadsch.exe in order to extend the AD, I had the following errors :
Error Code = 8202, at the Class MS-SMS-Managament-Point creation step and further…

I just reran the command, and it went through without any problems.. Just wanted to share it with people that may have the same issue..
I have to mention that I have two DCs in my forests, so I am presuming that is a matter of replication time here.. isn’t it?


Why we are extending the schema before starting the SCCM installation?


Hi there,

These articles are fantastic. Excellent documentation.

One quick question though, If I have SCCM 2007 running already. For instance, from the System Management container, I see SMS-SITE-ABC (mSSMSSite) and other containers for ManagementPoint and ServerLocatorPoint exist. Should it cause any issue if I deploy SCCM2012 using a differnet site name?

Can both system run in Paralle?



This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish. Accept Read More