Registry modification required to allow write operations to schema

By default, Microsoft Windows 2000 domain controllers permit only read access to the schema. This article describes how to edit the registry on a Windows 2000 domain controller to permit write operations to the schema.

If you attempt to add attributes to the schema before you make the registry change that is described in this article, you may receive the following error message: Note Even though the Active Directory is based on a multi-master administrative model, some operations allow only a single master. Schema management is one of these operations. Only one domain controller at a time is permitted to write to the schema. This role is known as Schema Flexible Single Master Operations (FSMO). You must ensure that the Active Directory Schema Manager snap-in is pointed at the schema FSMO. If you have only a single Windows 2000 domain controller in your network, it is always the schema FSMO.

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

Management of the Active Directory schema is not expected to be a frequently performed task and care must be exercised when modifying the schema. Microsoft Windows 2000 has a new administrative group called Schema Administrators. Management of the schema is restricted to members of the Schema Administrators group.

A registry modification to allow write operations to the schema is necessary before a Schema Administrator can create and modify classes and attributes using the Active Directory Schema Manager snap-in.

To modify the registry to allow write operations to the schema, create a new REG_DWORD value named "Schema Update Allowed" with a data value of "1" in the following registry key: It is not necessary to reboot the computer. The Active Directory service automatically detects the change. To disable schema updates on this domain controller, change the data value to "0".