A lot of requests have come up in the past both on the Microsoft TechNet forums and during previous engagements around how to mitigate the risks involved in extending the AD schema for Lync Server 2010.

There are rollback processes that come with Lync Server 2010 to remove the forest and domain level changes, but once you’ve done the schema level change, there’s no way of rolling back the changes using the Lync Server 2010 tools.

For a lot of IT teams, this will be acceptable as there is inherent faith in Microsoft’s ability to extend its own schema.
However, if your AD environment is heavily regulated by IT governance and your change control guidelines require a back out process for each change, there is a way to provide this. I’ll outline each step below.

Isolating the Schema Master from AD

To provide a back out plan for this change, the following risk mitigation prerequisite steps must be carried out prior to running the actual AD schema preparation step:

1. Log on to the domain controller that holds the Schema Master FSMO role.
2. Temporarily suspend AD replication capability from the domain controller using the following step
1. From a Command Prompt, run:
   repadmin /options +DISABLE_OUTBOUND_REPL

This process will suspend outbound AD replication from this domain controller, meaning changes we make won’t replicate to all of AD. Alternatively, you can disable the NIC of the machine, or disconnect it completely if it is a physical machine to achieve the same outcome.

Running Schema Preparation

To prepare schema for Lync, log onto the domain controller that holds the Schema Master FSMO role. You can then prepare the schema using either the Lync Server 2010 Deployment Wizard or the Lync Server 2010 Management Shell.

I’m not going to republish what is already documented, so here are the Microsoft TechNet library articles for performing the Schema Preparation step using both methods mentioned above:

Using Setup to Run Schema Preparation

Using Cmdlets to Run Schema Preparation

To prepare schema of the forest, you must be using an account with Schema Admins group membership.

Verifying Schema Preparation Completed Successfully

From the previously linked TechNet article:

1. Log on to a domain controller as a member of the Enterprise Admins group.
2. Open ADSI Edit by running adsiedit.msc from the Run command.
3. On the Action menu, click Connect to.
4. In the Connection Settings dialog box under Select a well known Naming Context, select Schema, and then click OK.
5. Under the schema container, search for CN=ms-RTC-SIP-SchemaVersion. If this object exists, and the value of the rangeUpper attribute is 1100 and the value of the rangeLower attribute is 14, then the schema was successfully updated. If this object does not exist or the values of the rangeUpper and rangeLower attributes are not as specified, then the schema was not modified.

Reintroducing the Schema Master to AD

Once you’ve verified that the AD schema preparation was successful, you can roll back the risk mitigation prerequisite by completing the following steps:

1. Log on to the domain controller in the domain that holds the Schema Master FSMO role.
2. From a Command Prompt, run:
   repadmin /options -DISABLE_OUTBOUND_REPL.

If you chose the option to disable/disconnect the NIC, you can reconnect/re-enable this now.

From here, you can carry out the AD Forest and Domain preparation steps for Lync.