SQL MA schema refresh error

SQL MA failed to retrieve schema with error 0x80231100. For me sollution was simple - add port to SQL server (replacement of old server and tests with a new server). So from someSQL.some.domain to someSQL.some.domain,4773 - is enough to refresh schema.

to use AD LDS (previously ADAM) or not?

Why to use (in 2018/2019) LDS service if we have ADFS, Active Directory and clouds? From my experience in IT:

• it is much easier (mentally) to extend schema in dedicated directory service nor in Active Directory
• there are many older applications or they want just use LDAP not ADFS and You want do it more secure than giving access to production directory service
• you can have multiple instances of the same data or with different settings and scopes of attributes, for example You can give only login names and phone numbers for company A and the same data with group membership for company B without access to not needed data
• it is very lightweight - of course - if You will create application with wrong long queries You can kill every server - I saw it at one company - they didn't use group membership info and they try to find membership by browsing groups - one by one to find in which groups user is a member of. They have 20-40k users and 25k groups so please, imagine, how can it work. After my review I pointed them, that memberof property is available in OpenLDAP, AD LDS and almost in every modern directory service.
• it can be fully separated from main domain in scenario with publishing data in not secure environment - passwords can be sychronized as well

to extend a schema or not? cons and pros

To extend a schema or - that is the question... Yes, what are the positive and negative aspects of this process:

• positive - You will have just custom - prepared for Your environment classes and properties
• positive - You will avoid some unexpected behaviors like - You hid some attribute - because it is sensitive an after some patch or fix it is now - again - visible for everyone
• negative - it is irreversible - you couldn't fully remove it from You schema
• negative - it is not standard property or class - somebody will ask You - how it is possible, that You have some custom attributes, but You don't use standard attributes?
• negative - it is dangerous - just kidding - it is just quite normal operation so it is neutral for every environment of course You should sit on Your hands before the change, test and rethink names, but it is quite normal operation - of course as long as You don't have a plan to add attribute called "DisplayName"...

oid for Active Directory classess and attributes

In Microsoft They have:
1.2.840.113556.1.5.9 which is described below:

Value Meaning Description
1 ISO Identifies the root authority.
2 ANSI Group designation assigned by ISO.
840 USA Country/region designation assigned by the group.
113556 Microsoft Organization designation assigned by the country/region.
1 Active Directory Assigned by the organization.
5 Classes Assigned by the organization.
9 user class Assigned by the organization.

OID can be registered for organization in IANA in node:
1 - ISO
3 - identified-organization
6 - dod
1 - internet
4 - private
1 - enterprise
x - my organization (of course I know it, but I'll not provide it here

Using the same schema as Microsoft I can use:
1.3.6.1.4.1.x.1. - Active Directory
1.3.6.1.4.1.x.1.1. - classess
1.3.6.1.4.1.x.1.2. - attributes

Exchange 2010 and Active Directory 2012R2 - compatibility

Just to remember:
from Paul Cunningham blog
from Technet web site
Exchange 2010 is no longer a blocker for 2012R2 domain controllers - with SP3 and RU5 of course