

How to create ldap server in windows step by step guide: a practical, beginner-friendly route to setting up an LDAP server on Windows, with real-world tips and common pitfalls. Quick fact: LDAP servers help you centralize user authentication, authorization, and directory data, making it easier to manage large organizations. In this guide, you’ll find a straightforward step-by-step plan, plus helpful formats to keep you moving, including checklists, tables, and example configurations.
What you’ll learn
- Why you’d want an LDAP server on Windows and what it can do for your environment
- The best Windows-based LDAP options, including OpenLDAP on Windows, and Microsoft’s Active Directory Lightweight Directory Services AD LDS
- A step-by-step setup flow for a simple LDAP server, plus configuration tips
- How to verify your LDAP server is working and how to troubleshoot common issues
- Real-world best practices for security, backups, and maintenance
Useful URLs and Resources text only
- Microsoft Learn – Active Directory Lightweight Directory Services – docs.microsoft.com
- OpenLDAP – openldap.org
- TechNet or Microsoft Docs for Windows Server trial and setup instructions
- Reddit r/sysadmin LDAP discussions
- Stack Overflow LDAP-related questions and answers
- Wikipedia – Lightweight Directory Access Protocol
- DigiCert or Let’s Encrypt for TLS certificates if you’re setting LDAPS
- Quick overview: LDAP on Windows — options and goals
- What is LDAP? A protocol for querying and modifying directory services.
- Why Windows? If your environment uses Windows workstations, Windows servers, or Azure AD, you’ll want something that integrates smoothly.
- Two common paths:
- AD LDS Active Directory Lightweight Directory Services on Windows Server
- OpenLDAP running on Windows via Cygwin or native builds
- Choosing the right solution
- AD LDS pros:
- Native Windows integration, good tooling, straightforward management via Active Directory Users and Computers ADUC when the right snap-ins are installed
- Separate from your domain controller, reducing risk
- Strong Microsoft support and documentation
- OpenLDAP on Windows pros:
- Open standard, wide compatibility with many applications
- Flexible schema and replication
- Considerations:
- Security requirements LDAPS/TLS
- Access patterns read-heavy vs write-heavy
- Backup and disaster recovery needs
- Your current infrastructure and skill set
- Prerequisites and planning
- Hardware and OS:
- Windows Server 2016/2019/2022 recommended for AD LDS
- Ensure latest Windows updates and a supported .NET version if needed
- Network:
- Static IP for the LDAP server
- Proper DNS resolution for clients
- Security:
- Decide on LDAPS LDAP over TLS for encrypted traffic
- Prepare a certificate from a trusted CA or internal PKI
- Accounts and permissions:
- Create an admin account with least-privilege access for LDAP setup
- For AD LDS, you’ll also need an experimental instance name and service accounts
- Step-by-step: Setting up AD LDS on Windows Server
Note: This section assumes you’re using Windows Server with GUI. Commands can be adapted for PowerShell where available.
Step 1: Install the AD LDS role
- Open Server Manager
- Choose Manage > Add Roles and Features
- In the Roles and Features wizard, select Active Directory Lightweight Directory Services
- Proceed with default features and install
- Reboot if prompted
Step 2: Create an AD LDS instance
- Open AD LDS Setup Wizard found in Administrative Tools after installation
- Choose Install a new instance
- Provide an instance name for example, LDAPTest
- Choose a port default LDAP 389; for LDAPS choose 636, ensure firewall allows it
- Choose a data store location path for the AD LDS database files
- Create a Windows service account for the AD LDS instance
- Complete the wizard and start the service
Step 3: Configure the directory schema and partitions
- Use ADSI Edit adsiedit.msc to connect to your AD LDS instance
- Create or modify partitions naming contexts as needed
- Add organizational units OUs and security groups to reflect your organizational structure
- Define objects like users and groups you can import from an existing AD if needed
Step 4: Set up access control and authentication
- Define access control lists ACLs to limit who can read or modify directory data
- Decide on authentication method simple bind, SASL, or SASL over TLS
- If you’ll use LDAPS, install your TLS certificate on the AD LDS instance
- Test authentication with an LDAP client e.g., Softerra, ldapsearch using the instance’s hostname and port
Step 5: Enable LDAPS optional but recommended for security
- Obtain a valid certificate for the server name used by clients CN must match the server name
- Import the certificate into the local computer’s Personal store and bind it to the AD LDS service
- Restart the AD LDS service so TLS binding takes effect
- Verify by using an LDAP client with ldaps://yourserver:636
Step 6: Backups and maintenance
- Schedule regular backups of the AD LDS data store and log files
- Test restore procedures in a non-production environment
- Monitor event logs for LDAP-related issues
- Keep the server patched and updated
- Step-by-step: Running OpenLDAP on Windows
If you prefer OpenLDAP, use a Windows-compatible build or use WSL/Cygwin. Here’s a high-level flow:
Step 1: Install prerequisites
- Install a Windows-compatible OpenLDAP package or use WSL with Ubuntu
- Ensure you have a TLS library if you plan to enable LDAPS
Step 2: Install and configure OpenLDAP
- Install slapd and ldapadd/ldapmodify tools
- Create a base DN for example: dc=example,dc=com
- Create initial entries dc=example,dc=com, ou=People, and initial user entries
Step 3: Add schemas and data
- Load standard core schema and cosine, inetorgperson depending on your needs
- Add organizational units and users/groups
Step 4: Enable TLS
- Generate or obtain TLS certificates
- Configure slapd.conf or slapd.d with TLS settings
- Restart OpenLDAP and test with ldaps://
Step 6 How to test and verify
- Basic LDAP queries:
- Connect using ldapsearch -x -H ldap://localhost -D “cn=admin,dc=example,dc=com” -W -b “dc=example,dc=com” “objectClass=*”
- Check that users and groups resolve as expected
- For AD LDS, use LDP.exe a GUI LDAP tool to browse and test operations
- Netstat -an to verify listening ports 389 LDAP and 636 LDAPS if TLS is configured
- Check firewall rules to ensure the appropriate ports are allowed
- Security best practices
- Use LDAPS or StartTLS to encrypt traffic
- Enforce strong passwords and password aging policies for directory accounts
- Limit bind privileges to the minimum necessary
- Implement audit logging for directory changes
- Regularly rotate server certificates and manage trust chains
- Segment the LDAP server behind a firewall or VPN for sensitive environments
- Performance and scalability tips
- Use indexing on frequently searched attributes for AD LDS and OpenLDAP
- Separate read-heavy and write-heavy workloads if possible
- Consider replication if you need high availability AD LDS supports replication
- Monitor latency and LDAP response times; if you see slow responses, examine query patterns and server load
- Troubleshooting common issues
- Issue: LDAP server not reachable
- Check that the service is running, firewall allows port 389/636, hostname resolves
- Issue: Certificate trust errors on LDAPS
- Ensure the client trusts the server certificate chain; import CA cert if using internal CA
- Issue: Access denied errors
- Verify ACLs, bind DN, and credentials
- Issue: Schema or attribute not found
- Confirm the correct schema is loaded and attributes exist
- Issue: Slow responses
- Check server resource usage CPU, memory, optimize indexes, review client query patterns
- Real-world scenarios and examples
- Small business onboarding 50 employees: AD LDS with a proprietary app integration
- IT management in mixed environments: OpenLDAP for Linux apps, AD LDS for Windows apps
- Education labs: LDAP serves student accounts and application authentication across devices
- Maintenance checklist
- Daily: monitor service status, basic health checks
- Weekly: verify backups, review logs
- Monthly: apply Windows updates, patch LDAP software, test failover
- Quarterly: revalidate TLS certificates, audit access controls
- Quick-start cheat sheet
- Decide on AD LDS vs OpenLDAP
- Install the chosen solution
- Configure base DN and partitions
- Create admin user and test bind
- Enable TLS if possible
- Set up backups and monitoring
- Document the directory structure and access policies
Frequently Asked Questions
How do I choose between AD LDS and OpenLDAP on Windows?
AD LDS is tightly integrated with Windows and is easier to manage with familiar tools. OpenLDAP offers broader cross-platform compatibility and flexibility. If you’re primarily in a Windows ecosystem and need something quickly maintainable, AD LDS is usually the better starting point.
Can LDAP run on Windows without Active Directory?
Yes. You can run OpenLDAP on Windows via native builds, Cygwin, or WSL. LDAPS is recommended for secure communication.
What ports should I open for LDAP?
Default LDAP uses port 389. If you enable LDAP over TLS LDAPS, use port 636. If you’re using StartTLS, you start with 389 and upgrade to TLS during the session.
How do I enable TLS for LDAP?
Obtain or generate a certificate for the server, install it on the LDAP service, and configure the service to use TLS. Restart the service and test with an LDAP client using ldaps:// or StartTLS.
What’s the best way to backup LDAP data?
Regular backups of the data store and configuration are critical. Use the built-in backup tools of AD LDS or the equivalent for OpenLDAP, and verify restorations periodically.
How do I test LDAP queries quickly?
Use ldapsearch OpenLDAP tools or LDP.exe Windows tool. Try basic queries like listing all entries under your base DN and searching for specific object classes.
How can I secure LDAP against brute-force attacks?
Limit bind attempts, implement account lockout policies, use strong authentication methods, and enforce TLS to prevent credential interception.
How do I troubleshoot binding problems?
Check the bind DN, password, and the LDAP server’s access controls. Confirm the server is listening on the expected port and that the client can reach it.
Can LDAP scale with growing user data?
Yes, with proper indexing, partitioning, and, if needed, replication. Plan for future growth during the initial design.
What are the common signs of LDAP schema issues?
Missing attributes, objects not appearing as expected, or client applications failing to bind due to not recognizing certain object classes.
Yes, you can create an LDAP server on Windows by using AD DS Active Directory Domain Services or AD LDS Active Directory Lightweight Directory Services and following these steps. In this guide, you’ll get a clear, practical approach to choosing between AD DS and AD LDS, preparing your environment, installing and configuring the directory service, enabling secure LDAP, testing connectivity, and keeping things running smoothly. We’ll cover both GUI and PowerShell methods, include real-world tips, and outline common mistakes to avoid. If you’re setting this up for the first time or planning a migration from another LDAP store, this step-by-step guide will help you stay organized and productive.
Useful URLs and Resources un clickable text
- Microsoft Docs – Install Active Directory Domain Services
- Microsoft Learn – Manage LDAP on Windows
- Microsoft Docs – Deploy and configure AD DS
- Microsoft Docs – LDAPS: LDAP over TLS
- LDAP protocol overview – ldap.org
- OpenLDAP Project – Official documentation
- AD LDS – Install and configure AD Lightweight Directory Services
- LDP tool guide – LDAP Data Interchange Format and testing
- Windows Server Security Baselines – Microsoft Secure Score
Introduction summary
- What you’ll learn: how to set up a Windows LDAP server using AD DS or AD LDS, how to decide which path fits your needs, required prerequisites, step-by-step installation and basic configuration, how to secure LDAP with LDAPS, how to test connectivity, and how to plan for backups and high availability.
- Who this is for: IT admins, system engineers, and developers who need centralized identity data on Windows, or who need a Windows-compatible LDAP store for apps and services.
- Format you’ll see: quick-start checklists, step-by-step commands, practical tests, troubleshooting tips, and a thorough FAQ to cover common questions.
Body
What is LDAP and why Windows?
LDAP Lightweight Directory Access Protocol is the standard protocol used to access directory services. It’s the backbone for authentication, authorization, user provisioning, and address lookups in many enterprise apps. On Windows, LDAP is most commonly exposed via Active Directory AD DS or AD LDS. Here’s the practical takeaway:
- AD DS provides a full Windows domain controller with DNS integration, group policy, and centralized authentication.
- AD LDS offers a lighter, multi-master directory service that doesn’t enforce a domain or shared security accounts, making it ideal for application directories, testing, or isolated identity stores.
- Both options use the LDAP protocol port 389 by default and can be secured with LDAP over TLS LDAPS on port 636.
When you’re deciding which path to take, ask:
- Do you need domain services, Kerberos-based authentication, and policy enforcement? Choose AD DS.
- Do you need an isolated LDAP store for applications or developers without impacting a domain? Choose AD LDS.
Choose Between AD DS and AD LDS
AD DS Active Directory Domain Services
- Pros: Centralized authentication, group policy, DNS, scalable to large enterprises, strong security model.
- Cons: Requires proper domain planning, more complex to manage, changes ripple through the domain.
AD LDS Active Directory Lightweight Directory Services
- Pros: Lightweight, no domain, easy to replicate between servers, ideal for application directories or test environments.
- Cons: No Kerberos or Group Policy, separate from Windows domain security.
Key planning notes:
- Plan for at least two domain controllers if you go with AD DS for high availability.
- If you’re using AD LDS for apps, decide on application partitions, naming contexts, and replication topology early.
- Consider certificate management for LDAPS if you plan to secure LDAP traffic.
Prerequisites and Planning
Before you install anything, gather these basics:
- A Windows Server 2019/2022 instance physical or virtual with up-to-date patches.
- A static IP address, proper DNS configuration, and network reachability between servers.
- Administrative credentials on the server.
- A plan for a domain name for AD DS or an AD LDS instance name for AD LDS.
- A plan for LDAPS: obtain or issue a certificate trusted by clients PKI setup or internal CA.
Recommended hardware for a small to mid-size deployment: How to create dhcp server in windows server 2016 step by step guide 2026
- AD DS domain controller: minimum 2 CPU cores, 4 GB RAM 4+ GB recommended, 60 GB disk for system + logs + AD database, more for larger deployments.
- AD LDS instance: similar or lighter depending on directory size and replication.
Security considerations:
- Use a strong, unique Administrator password and a separate service account for service-related tasks.
- Plan firewall rules to only allow LDAP 389 and LDAPS 636 from trusted hosts. enable monitoring and logging.
- Regularly audit security policies and limit permissions for administrative tasks.
Step-by-Step: Install and Configure AD DS on Windows Server
This path creates a domain controller and a full Windows domain. Here are practical steps you can follow.
Step 1: Prepare the server
- Set a static IP address.
- Ensure DNS points to a valid DNS server preferably the server itself if it’s the first DC.
Step 2: Install the AD DS role
- GUI method:
- Server Manager > Add roles and features > Roles > select Active Directory Domain Services > Install.
- PowerShell method:
- Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools
Step 3: Promote the server to a domain controller How to Create DNS Server in CentOS a Step by Step Guide 2026
- After installation, open Server Manager > Promote this server to a domain controller.
- Create a new forest, specify Domain Name e.g., contoso.local, set a Safe Mode DSRM password, and choose DNS options as needed.
- $securePwd = ConvertTo-SecureString “YourSafePassword” -AsPlainText -Force
- Install-ADDSForest -DomainName “contoso.local” -DomainNetbiosName “CONTOSO” -SafeModeAdministratorPassword $securePwd -InstallDNS
Step 4: Complete the wizard and reboot
- After promotion, the server will reboot. The Domain Controller is now active.
Step 5: Post-setup checks
- Verify with PowerShell:
- Get-ADDomain
- Get-ADForest
- Get-ADDomainController -Filter *
- Create an OU, a test user, and a test group to validate basic operations.
Step 6: Secure and extend
- Enable LDAPS if you need encrypted LDAP see LDAPS section below.
- Create organizational units OUs to organize users and devices.
- Implement Group Policy where appropriate to standardize security settings.
Step 7: High availability and backups
- Add at least one additional domain controller in a separate server or host to ensure resilience.
- Regularly back up AD DS using Windows Server Backup or a recommended enterprise backup solution.
- Test restores in a non-production environment to validate recovery plans.
Code snippet: basic AD DS install and domain creation PowerShell How to Create Client in Windows Server 2008 a Step by Step Guide: Computer Accounts, Domain Join, and Automation 2026
- Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools
- $securePwd = ConvertTo-SecureString “YourSafePassword” -AsPlainText -Force
- Install-ADDSForest -DomainName “contoso.local” -DomainNetbiosName “CONTOSO” -SafeModeAdministratorPassword $securePwd -InstallDNS
AD DS testing tips:
- Use ldp.exe to test LDAP queries against your domain controller bind with a user and search base DN like “dc=contoso,dc=local”.
- Check event logs for AD DS health: Directory Service, Directory Service Applications, DNS Server.
Step-by-Step: Install and Configure AD LDS Active Directory Lightweight Directory Services
If you don’t need domain services but want a Windows-based LDAP directory for apps, AD LDS is the way to go. Here’s a practical setup path.
Step 1: Install AD LDS
- Server Manager > Add roles and features > Features > AD Lightweight Directory Services.
- Install-WindowsFeature -Name ADLDS
Step 2: Run the AD LDS Configuration Wizard
- Launch the AD LDS Setup Wizard to create a new instance.
- Choose an instance name e.g., AppDirectory and specify ports default 389 or 636 for LDAPS if you configure SSL.
- Create an application partition and a service account if required by your apps.
- Finish the wizard and start the instance.
Step 3: Create and manage directory data How to Create Bots in Discord Server a Step-By-Step Guide for Bot Development, Discord Bot Tutorial, and Automation 2026
- Use LDP.exe or an LDAP tool to connect to the AD LDS instance.
- Create an OU-like container, add entries people, groups, or application-specific objects as needed.
- Secure the LDAPS path if you plan to encrypt traffic later.
Step 4: Secure and monitor
- If you plan to enable LDAPS, install a certificate for the AD LDS instance and configure the LDAPS port.
- Lock down access to the directory store to trusted clients and use logging for auditing changes.
Step 5: Backup and maintenance
- Regular backups of the AD LDS database are essential. use the appropriate AD LDS tools or export with LDIFDE where applicable.
- Monitor replication and replication topology if you have multiple AD LDS instances.
Notes for AD LDS:
- AD DS provides Kerberos-based authentication and policy. AD LDS focuses on application data and does not enforce a Windows domain.
- AD LDS is multi-master, so any replica can answer read/write requests, but plan for data consistency and conflict resolution.
Secure LDAP: Enabling LDAPS LDAP over SSL
If you’re exposing LDAP to clients across networks, securing traffic with LDAPS is critical. Here’s a practical approach:
- Obtain or issue a certificate for the directory service domain controllers or AD LDS instances. Use a certificate trusted by your client machines.
- Bind the certificate to the LDAP service:
- For AD DS, LDAPS uses the certificate bound to the server’s SSL certificate. ensure the certificate has a private key and a proper subject name DNS name matches the server name.
- For AD LDS, use the certificate store and management tooling to bind the cert to the instance’s TLS listener.
- Open firewall rules to allow TCP 636 LDAPS from trusted networks and clients.
- Test with LDP.exe:
- Connect to ldaps://your-ldaps-host:636
- Bind with a valid user and try a basic query e.g., base search with a simple filter
Common LDAPS pitfalls: How to create an sql server with html in eclipse the ultimate guide: Build Database-Driven HTML Apps in Eclipse 2026
- The certificate chain or private key is missing or not trusted by clients.
- The DNS name on the certificate does not match the server’s hostname.
- Firewall or network devices block port 636 between clients and servers.
Connectivity Testing and Validation
- Windows tool: LDP ldp.exe
- Connect to your server on 389 LDAP or 636 LDAPS.
- Perform a bind and a simple search, e.g., base DN “dc=contoso,dc=local” with filter “objectClass=*”.
- Cross-platform testing: ldapsearch Linux/macOS or LDAP browser tools can be used with the same credentials and base DN.
- Basic checks:
- Can you authenticate with a real user account?
- Can you read common attributes cn, sAMAccountName, userPrincipalName, memberOf?
- Can you search for groups and nested memberships?
- Performance and replication checks:
- Ensure replication is healthy if you have multiple domain controllers:
- In AD DS, use Repadmin /replsummary
- In AD LDS, verify replication status per instance
- Ensure replication is healthy if you have multiple domain controllers:
Firewall, Security, and Compliance
- Open: LDAP 389 and LDAPS 636 between clients and servers. close all other ports unless required.
- Enforce least privilege: separate admin accounts from user accounts. use secure channels for administration.
- Audit logging: enable directory service auditing to monitor create/read/update/delete events on LDAP data.
- Regularly rotate service accounts and review permissions on directory objects.
Backups, Recovery, and High Availability
- AD DS: Always run at least two Domain Controllers for redundancy. Regular backups of system state and ADDS are recommended.
- AD LDS: Backups of the directory data store and configuration are essential. ensure LDIF exports are tested.
- Disaster recovery: Periodically simulate a recovery drill restoring AD DS from backup in a non-production environment.
- Documentation: Keep a current topology diagram showing domain structure, sites, and replication links.
Performance and Best Practices
- Implement proper indexing in AD DS for faster searches and reduce replication load.
- Keep the schema and naming contexts clean. avoid unnecessary custom attributes unless you have a real app requirement.
- Document OU structures and delegation boundaries for administrative tasks.
- Use read-only domain controllers RODCs for branch offices with limited physical security if needed.
Common Pitfalls and How to Avoid Them
- Not planning DNS properly: AD DS relies on DNS. misconfigurations can cause login and replication failures.
- Overcomplicating OU structure: A too-deep or overly complex OU structure makes administration harder.
- Failing to test LDAPS before deployment: LDAP over SSL requires certificate readiness and client trust.
- Skipping backups: AD data is critical. never run AD DS or AD LDS in production without validated restore procedures.
Data and Statistics Contextual Authority
- LDAP remains the de facto protocol for directory services in many enterprise environments. Windows-based deployments use LDAP primarily through AD DS and AD LDS.
- For a typical medium-sized deployment, enterprises often plan for at least two domain controllers with separate failure domains to ensure availability during maintenance or outages.
- Encrypting LDAP traffic LDAPS is a best practice increasingly enforced by security policies, especially for sensitive identity data and inter-site replication.
- Regular backups and tested restores are among the most common factors separating successful disasters from long outages in identity services.
Frequently Asked Questions
Frequently Asked Questions
Is LDAP the same as Active Directory?
Yes, LDAP is the protocol used to access directory data, while Active Directory is the directory service that implements LDAP as well as other protocols and features like Kerberos, DNS integration, and policy. AD DS provides LDAP under the hood. AD LDS offers LDAP without the domain services.
Should I use AD DS or AD LDS for my project?
Use AD DS if you need a domain with centralized authentication, policy, and device management. Use AD LDS if you need a standalone LDAP store for applications, testing, or an isolated directory that doesn’t participate in the domain.
How do I install AD DS on Windows Server?
Install the AD-Domain-Services role, then promote the server to a domain controller, choosing to create a new forest or join an existing one. You can do this via Server Manager or with PowerShell Install-WindowsFeature and Install-ADDSForest.
How do I promote a server to a domain controller?
During the AD DS installation or afterward via Server Manager, choose the option to Promote this server to a domain controller, configure domain details, and complete the wizard. Reboot and verify with AD tools. How to create a reverse lookup zone in dns server step by step guide 2026
How do I enable LDAPS on Windows Server?
Obtain a certificate that can be used for server authentication, import it into the local computer’s certificate store, bind the certificate to the LDAP service the process varies by AD DS or AD LDS, and open port 636 through the firewall. Test with LDP.exe using ldaps://.
Can I run LDAP without Active Directory on Windows?
Yes, with AD LDS or third-party LDAP implementations, you can run an LDAP directory without creating a Windows domain. AD LDS is the Windows-provided option designed specifically for this purpose.
How do I test LDAP connectivity from a client machine?
Use LDP.exe or an LDAP client tool to connect to your LDAP server on port 389 LDAP or 636 LDAPS. Bind with a valid account and perform a simple search to verify connectivity and permissions.
How do I secure LDAP traffic in production?
Use LDAPS LDAP over TLS, ensure proper certificate management, restrict network access to trusted hosts, enable auditing, and apply security baselines. Regularly rotate credentials used for directory access.
How do I plan for high availability of LDAP services?
For AD DS, deploy multiple domain controllers across sites with proper replication topology. For AD LDS, deploy multiple instances with a clear replication plan if your architecture requires it. Ensure you have tested backups and disaster recovery plans. How to Create an Alias in DNS Server 2008 R2 Step by Step Guide 2026
How do I back up and restore AD DS?
Use Windows Server Backup or a preferred backup solution that supports AD DS state backups, including System State data. Regularly test restorations to verify recovery procedures.
How do I migrate from an OpenLDAP server to AD DS or AD LDS?
Plan a phased migration: map OpenLDAP schemas and data to AD DS/AD LDS structures, export data from OpenLDAP LDIF, transform it to match the target schema, import into the Windows directory using tools like LDIFDE or AD tooling, and validate data integrity and permissions after migration.
Sources:
Nordvpnのthreat protectionって何?vpnだけじゃない、超便利機能徹底とNordVPN Threat Protectionの仕組みと実用活用ガイド
设置ssr 的完整使用指南:在 VPN 场景下搭建 ShadowsocksR 的步骤、工具、效能与隐私考量 How to create a schema in sql server a step by step guide 2026