Create System Management Container for SCCM and Extend AD Schema

Prajwal Desai
Posted by Prajwal Desai
Create System Management Container for SCCM

In this post, I will show you how to create system management container for SCCM and extend the Active Directory schema (AD schema) for SCCM. We will also go through the steps to delegate permissions on the system management container and prepare Active Directory for site publishing.

After you install the active directory for SCCM, the first step is to extend the active directory schema. The next step is to create a system management container for SCCM and assign full control permissions to the container.

Getting Active Directory ready for site publishing is one of the things you need to do before you can install SCCM. There are several steps involved, which I will outline in this post. For every domain with a primary or secondary site, you must create a system management container only once. This container will be used to publish data to Active Directory.

What is System Management Container in SCCM?

The System Management is a container located in the System folder of the Active Directory which is used by the site server and the management points to store published data like boundaries and certificates.

Ad imageAd image

If the Active Directory schema was already extended for SCCM 2007 or Configuration Manager 2012, then you don’t need to extend the schema again. The schema extensions are unchanged and will already be in place in AD. In other words, extending the AD schema for SCCM is a one-time action for any forest.

Prepare Active Directory for site publishing

Before you create system management container for SCCM and extend the Active Directory schema for ConfigMgr, here are some important prerequisites.

  • There are no new Active Directory schema extensions for Configuration Manager current branch. If you previously extended the schema during the SCCM installation, you don’t have to extend the schema again.
  • When you extend the active directory schema for Configuration Manager, it is a forest-wide, one-time, irreversible action.
  • To extend AD schema for SCCM, you must use an account that is a member of the Schema Admins group.
  • You can extend the schema before or after you install a Configuration Manager site. However, I recommend you extend AD schema for SCCM before you start to configure your sites and hierarchy settings.
  • After you extend AD schema for SCCM, the Active Directory global catalog replicates throughout the forest.

Create System Management Container for SCCM

Let’s look at the steps to create system management container for SCCM.

Step 1: Login to Active Directory domain controller with an account that’s a member of the Schema Admins security group. Sign in with that account to the schema master domain controller. Launch the Server Manager and from the top menu, click Tools and select ADSI Edit. Right-click ADSI Edit and select Connect to.

Launch ADSI Edit Tool
Launch ADSI Edit Tool

Step 2: On the ADSI Connection Settings, the naming context should be Default naming context. Do not change the LDAP path, click OK.

ADSI Connection Settings
ADSI Connection Settings

Step 3: In the ADSI edit Console, expand the Default Naming Context. Right click CN=System and select New > Object.

Create System Management Container for SCCM
Create System Management Container for SCCM

Step 4: You must select a class for the system management container object that you are creating. In the Create Object window, select Container, and then select Next.

Create System Management Container for SCCM
Create System Management Container for SCCM

Step 5: Enter the container value as System Management and click Next.

Create System Management Container for SCCM
Create System Management Container for SCCM

Step 6: Click Finish to close the Create Object wizard. Refresh the ADSI edit and the system management container should be now visible under CN=System directory.

Create System Management Container for SCCM
Create System Management Container for SCCM

    Assign Permissions to System Management Container

    After you create System Management Container for SCCM, the next step is to assign permissions to the System Management Container. For each container, you must give permissions to each site server’s computer account that will publish data to that domain. To delegate permissions on the system management container in SCCM, follow the steps below.

    Step 1: Launch the Active Directory Users and Computers console. Click View and select Advanced Features. Right click System Management container and select Delegate Control.

    Delegate Permissions to System Management Container
    Delegate Permissions to System Management Container

    Step 2: On the Delegation Control Wizard, click Add button.

    Delegate Permissions to System Management Container
    Delegate Permissions to System Management Container

    Step 3: In the Object Types window, check box the Computers and click OK. If you don’t perform this step, the SCCM computer account will not be visible in the ADUC console.

    Select Computers as Object Types
    Select Computers as Object Types

    Step 4: In the Select Users, Computers, or Groups window, type the SCCM Server name and click Check Names, the computer name should be resolved now. Click OK.

    Add SCCM Computer Account
    Add SCCM Computer Account

    Step 5: We have added the computer account of the Configuration Manager site server in this domain. Click Next.

    Assign Permissions to System Management Container
    Assign Permissions to System Management Container

    Step 6: On Tasks to Delegate window, select Create a custom task to delegate. Click Next.

    Assign Permissions to System Management Container
    Assign Permissions to System Management Container

    Step 7: In this step, you indicate the scope of the task you want to delegate. Select the default option This folder, existing objects in this folder, and creation of new objects in this folder. Click Next.

    Assign Permissions to System Management Container
    Assign Permissions to System Management Container

    Step 8: On the Permissions window, select the permissions you would like to delegate. Select all the checkboxes: General, Property-specific, Creation/Delegation of specific child objects. Under Permissions, enable Full Control. This will assign the SCCM computer account full permissions over the system management container including the descendent objects. Click Next.

    Assign Permissions to System Management Container
    Assign Permissions to System Management Container

    Step 9: We have successfully assigned permissions to the system management container. Close the Delegation of Control Wizard.

    Close Delegation Control Wizard
    Close Delegation Control Wizard

    The following video tutorial explains the creation of system management container for SCCM.

    How to Extend Active Directory Schema for SCCM

    When you manage on-premises clients, you should extend the Active Directory schema for Configuration Manager. An extended schema can simplify the process of deploying and setting up clients. An extended schema also lets clients efficiently locate resources like content servers. Extending the schema is a one-time action for any forest.

    You can perform the below steps either on Active Directory or any member server. To extend AD schema, always use an account that is a member of the Schema Admins security group.

    The steps to extend the active directory schema for SCCM are as follows:

    • Mount the SCCM setup media. Locate the folder: SMSSETUP\BIN\X64
    • Right-click file named “extadsch.exe”. Hold the shift key on the keyboard and right-click on the extadsch file and select copy as path.
    • Open the command prompt and paste the copied data and press Enter key.
    • This will extend Active Directory schema for SCCM.

    The output “Successfully extended the Active Directory schema” confirms that the AD schema has been extended successfully for SCCM.

    How to Extend Active Directory Schema for SCCM
    How to Extend Active Directory Schema for SCCM

    The AD Schema log file extadsch.log can be found in the root drive, C:\extadsch.log. Open it with a CMTrace log viewer or Notepad. The highlighted text shows that the Active Directory schema has been extended successfully.

    Modifying Active Directory Schema - with SMS extensions.
    DS Root:CN=Schema,CN=Configuration,DC=PRAJWAL,DC=LOCAL
    Defined attribute cn=MS-SMS-Site-Code.
    Defined attribute cn=mS-SMS-Assignment-Site-Code.
    Defined attribute cn=MS-SMS-Site-Boundaries.
    Defined attribute cn=MS-SMS-Roaming-Boundaries.
    Defined attribute cn=MS-SMS-Default-MP.
    Defined attribute cn=mS-SMS-Device-Management-Point.
    Defined attribute cn=MS-SMS-MP-Name.
    Defined attribute cn=MS-SMS-MP-Address.
    Defined attribute cn=mS-SMS-Health-State.
    Defined attribute cn=mS-SMS-Source-Forest.
    Defined attribute cn=MS-SMS-Ranged-IP-Low.
    Defined attribute cn=MS-SMS-Ranged-IP-High.
    Defined attribute cn=mS-SMS-Version.
    Defined attribute cn=mS-SMS-Capabilities.
    Defined class cn=MS-SMS-Management-Point.
    Defined class cn=MS-SMS-Server-Locator-Point.
    Defined class cn=MS-SMS-Site.
    Defined class cn=MS-SMS-Roaming-Boundary-Range.
    Successfully extended the Active Directory schema.
    Please refer to the ConfigMgr documentation for instructions on the manual 
    configuration of access rights in active directory which may still 
    need to be performed.  (Although the AD schema has now be extended, 
    AD must be configured to allow each ConfigMgr Site security rights to 
    publish in each of their domains.)

    Failed to Extend AD Schema for SCCM

    In certain environments, you may encounter errors while extending the Active Directory schema for SCCM. Listed below are some common AD schema errors and their associated solutions.

    SCCM: List of Active Directory Attributes and Classes

    After you extend the AD schema for Configuration Manager, the following classes and attributes are added to the schema. These are available to all SCCM sites in that Active Directory forest.

    SCCM Active Directory AttributesActive Directory Classes for SCCM
    cn=mS-SMS-Assignment-Site-Code
    cn=mS-SMS-Capabilities
    cn=MS-SMS-Default-MP
    cn=mS-SMS-Device-Management-Point
    cn=mS-SMS-Health-State
    cn=MS-SMS-MP-Address
    cn=MS-SMS-MP-Name
    cn=MS-SMS-Ranged-IP-High
    cn=MS-SMS-Ranged-IP-Low
    cn=MS-SMS-Roaming-Boundaries
    cn=MS-SMS-Site-Boundaries
    cn=MS-SMS-Site-Code
    cn=mS-SMS-Source-Forest
    cn=mS-SMS-Version
    cn=MS-SMS-Management-Point
    cn=MS-SMS-Roaming-Boundary-Range
    cn=MS-SMS-Server-Locator-Point
    cn=MS-SMS-Site
    SCCM: List of Active Directory Schema Attributes and Classes
    SCCM: List of Active Directory Schema Attributes and Classes
    SCCM: List of Active Directory Schema Attributes and Classes

    SCCM System Management Container FAQs

    Here are some FAQs about the system management container and extending AD schema for SCCM.

    What is System Management Container?

    System Management is a container located in System folder in Active Directory that is used by the site server and the management points to store published data like boundaries and certificates.

    What happens when you extend AD Schema for SCCM?

    When you extend the Active Directory schema for Configuration Manager, you introduce new structures to Active Directory. Configuration Manager sites use these new structures to publish key information in a secure location where clients can easily access it.

    Can you delete System Management Container?

    As long as your SCCM site is active, you should never delete system management container and any objects within it.

    Share This Article
    Prajwal Desai
    Posted by Prajwal Desai
    Follow:
    Prajwal Desai is a Microsoft MVP in Intune and SCCM. He writes articles on SCCM, Intune, Windows 365, Windows Server, Windows 11, WordPress and other topics, with the goal of providing people with useful information.
    27 Comments