Active Directory Object Class: an explanation

What you’ll learn:

Objects in Active Directory (AD) are the fundamental components that make up an AD network. Each object as a certain set of properties that define what properties they possess. This is where object classes come into play. In this article, we will take a look into what are AD object classes, its properties, and what are the types of object classes. Before getting into what an object class is, let’s take a look at what object attributes are.

What are object attributes?

Object attributes are entities that store pieces of information about the objects in the AD environment. For example, a user object would have attributes such as their first name, last name, telephone number, address, and other attributes that store data about the user that the user object references in the AD network.

There are several types of attributes like linked attributes, indexed attributes, and global attributes, and each of these attribute types differs in function such as collecting information about the objects, or storing information about other attributes such as defining syntaxes or classifying whether an attribute is mandatory, and more. Object attributes are defined by object classes in the AD schema. You can learn more about object attributes in this article.

What are Active directory object classes?

So, an object class contains the object attributes that define the properties of an object in Active Directory. Object attributes are classified hierarchically into several types of object classes. Hence, in simpler terms, object classes are hierarchical classifications of object definitions. An object class is defined by a classSchema object in the AD schema.

When an object is created in the AD environment, the operating system references the object class, and based on the object classes, the respective object attributes are given to the object in question. For example, let’s say that we want to create a user object. So, when creating a user object, the operating system will check the user class to see what properties the user object must have. The user class will contain the attributes for the object such as common name, canonical name, description, company, and more. So, all these attributes will be given to the user object, and the IT administrator who is creating the user object will have to fill the attribute details with information based on whether they are mandatory or not.

Types of Object classes in AD

Since object classes are hierarchically categorized, there will sub classes and super classes. In AD, an object class can be of three types, namely:

  • Abstract class
  • Structural class
  • Auxiliary class

Abstract class

An abstract class cts as a template class from which other classes can be derived. The topmost class in the hierarchy is always an abstract class. Abstract can be subclasses of other abstract classes only.

Structural class

A structural class can be a subclass or either an abstract class or another structural class. Structural classes are the actual classes from which object instances are created by referencing the attributes from this class.

Auxiliary class

Auxiliary classes can be subclasses or abstract classes or other auxiliary classes. Auxiliary classes are used to store sets of attributes that other classes can inherit. These are attributes that an object of a particular class need not necessarily have by default, but in some cases, might need.

Let’s say that you need to create a user object for a sales person. The AD schema would have an object class called Sales person, Let’s assume that the sales person object class is present like so in the classes hierarchy:

Top (Abstract) -> Person (Abstract) -> Organizational person (Abstract) -> User (Structural) -> Sales person (Structural)

The top class is always an abstract class. The person and organizational person classes would be abstract classes, each class inheriting the attributes of the superclass it is in. Then, we come to the structural classes that define the attributes of the sales person object along with the attributes inherited from its superclasses. This, the entire set of attributes is obtained for the sales person object.

Properties of an object class

A classSchema object in the AD schema will contain the following attributes:

Attribute Attribute description
cnThis is the naming attribute of an object class. The cn of a classSchema object must be unique in the schema container.
lDAPDisplayNameThe name that LDAP clients use to identify the object class. A class’s lDAPDisplayName must thus also be unique in the schema container.
schemaIDGUIDA GUID for the object class stored as an octet string. This GUID uniquely identifies the class.
adminDisplayNameThe display name of the classSchema object that appears in administrative tools.
governsIDThe OID of the object class that uniquely identifies this class.
rDnAttIdThis attribute dictates how the object class will be referenced, which means it will define the RDN syntax for this class.
mustContain, systemMustContainThis attribute defines all the the attributes that must be present (mandatory attributes) on instances of this class. After creation of the class, these properties cannot be changed.
mayContain, systemMayContainThis attribute defines all the the attributes that are optional  on instances of this class.
possSuperiors, systemPossSuperiorsThis attribute specifies the structural classes that can be legal parents of instances of this class.
objectClassCategoryThis attribute specifies the category of the class, which can be one of the following:Structural classAbstract class Auxiliary class
subClassOfAn OID that specifies which class is the immediate super class of this class, that is, the class from which this class is derived.
auxiliaryClass, systemAuxiliaryClassThis attribute specifies the auxiliary classes that this class inherits attributes from. This value cannot be modified after creation.
defaultObjectCategoryThis attribute denotes the distinguished name of this object class or one of its super classes.
defaultHidingValueThis attribute is a Boolean value that specifies whether this object should be visible or hidden in the Microsoft Management Console. If defaultHidingValue is set to TRUE, new object instances are hidden in the MMC.
If defaultHidingValue is set to FALSE, new instances of the object are displayed in the MMC.
If the defaultHidingValue value is not set, the default is TRUE.
systemFlagsThis attribute is an integer value that contains flags that define additional properties of the class.
systemOnlyThis attribute is a Boolean value that specifies whether only the Active Directory server can modify the class.
defaultSecurityDescriptorThis attribute specifies the default security descriptor for new objects of this class.
isDefunctThis attribute is a Boolean value that indicates whether the class is defunct. For more information, see Disabling Existing Classes and Attributes.
descriptionIt is a text description of the class for use by administrative applications.
objectClassThis attribute identifies the object class of which this object is an instance.



1 Star2 Stars3 Stars4 Stars5 Stars (4 votes, average: 4.75 out of 5)