One of our application teams chose to use SecureAuth to facilitate single sign-on (SSO) for user portal authentication.  The process makes an LDAP call on specific Active Directory attributes on user accounts.  One of the AD attribute requirements in the LDAP call was departmentNumber which is not natively in the global catalog replication set.  Therefore, we needed to add the attribute to the Global Catalog replication in Active Directory to support the process.

Below are the steps we took to add an attribute to global catalog replication.

 Pre-Install

1. Add the performer’s AD user account to the Schema Admins group.

Procedure

1.  Log on to the domain controller that hosts the schema master FSMO role.
2. Open a blank MMC console by typing mmc.exe from Start/Run.
3. Within the MMC, select File and then Add/Remove Snap-in.
4. From the resulting list, select Active Directory Schema.
5. From within the Active Directory Schema snap-in, navigate to the Attributes folder and scroll down on the right until you see the departmentNumber attribute to be added to the Partial Attribute Set.
6. Right-click the departmentNumber attribute and select Properties.
7. In the resulting window, select the check box that says Replicate this attribute to the Global Catalog and select OK to close the window.
8. Close the snap-in.

Post-Install

1. Remove the performer’s AD user account from the Schema Admins group.