Editing Active Directory (section)

===Objects used===
[[File:Publishing Company Network Diagram.png|thumb|A simplified example of a publishing company's internal network.  The company has four groups with varying permissions to the three shared folders on the network.]]Active Directory structures consist of information about [[Object (computing)|objects]] classified into two categories: resources (such as printers) and [[security principal]]s (which include user or computer accounts and groups). Each security principal is assigned a unique [[security identifier]] (SID). An object represents a single entity, such as a user, computer, printer, or group, along with its attributes. Some objects may even contain other objects within them. Each object has a unique name, and its definition is a set of characteristics and information by a [[Database schema|schema]], which determines the storage in the Active Directory.

Administrators can extend or modify the schema using the [[schema object]] when needed. However, because each schema object is integral to the definition of Active Directory objects, deactivating or changing them can fundamentally alter or disrupt a deployment. Modifying the schema affects the entire system automatically, and new objects cannot be deleted, only deactivated. Changing the schema usually requires planning.<ref>{{Cite book |title=Windows Server 2003: Active Directory Infrastructure |publisher=Microsoft Press |year=2003 |pages=1–8–1–9}}</ref>