Active Directory User Attribute List

active-directoryschemauser-accounts

I'm trying to find a list of Active Directory User Attributes that I can use for customization without having to extend the schema. We are using 2008R2 functional level.

I exported a list with powershell of all properties. But I don't know how to tell which are user-info that I can edit (such as displayname, phone, employee-id) and AD-Data that I shouldn't edit manually (dn,accountexpires). I can see some obvious ones from this list such as employee-id, extensionAttribute1-15.

Get-QADUser 'username' -IncludeAllProperties |  Get-Member -MemberType Properties

I have found a few websites that list all attributes, but none of them distinguish between user-info and AD-Data.

This Microsoft list divides properties up into Property sets: Public-Information, User-Logon etc. but still doesn't divide the list between user-info and AD-Data. It also doesn't include employee-id or the extensionAttribute1-15

Question: Does this list Active Directory User Attributes that I can use for customization exist?
Thanks

Edit:
Additional info:
Our developers want to attach some info to all user accounts for a new application. The first example of the data they wanted to attach was employee-id. This field already exists in AD. I'm not opposed to extending the schema, I just don't want change things unnecessarily or to duplicate fields that already exist. If I can just give them a list, there might be fields with appropriate names that we can just use. If not, then I will extend the schema.

Reworded question:
Which attributes can I use for my own purposes (eg. displayname, phone, employee-id) ? Which attributes should I leave alone (dn, lastModifiedDate, accountexpires)?

Best Answer

The short answer is that there are only really a couple attributes that are intended for cosmetic metadata on a user account like description and info. Even the extensionAttributeX ones aren't really intended for your customization. They're part of the Exchange schema extensions and should be considered "reserved" if you're actually running Exchange.

A better question is why are you trying to avoid extending your schema? There's nothing inherently risky about doing it. If you have a valid use-case for adding business specific custom metadata on a particular class, come up with a logical attribute name, and add it. Maybe make sure your ldif file works the way you intend on a temporary throwaway DC that you bring up first. But ultimately, it's the only way to guarantee that nothing else will step on it or be affected by it.

If you're trying to avoid it because of political issues (your team doesn't manage AD and the AD team is averse to schema changes), it's still in your best interest to fight the good fight and make a business justification for the change (assuming you actually have a good business justification).

If your need is only temporary, then maybe just use something like description or info knowing that your user management teams might screw up the data accidentally. It's also possible some poorly written third party software might have the same idea though and conflict with yours.

You may also want to update your question with more specifics about the type of data you're trying to add. There may be existing attributes you could use that are intended for your purposes already.

Response to Edit: As you pointed out, there is already an employeeID attribute you could use. There's also an employeeNumber attribute as well. But again, the answer to the root of your question is that there is no definitive list of pre-existing writable attributes that no other software uses. The best way to do what you're trying to do is open up the properties dialog for a user in your domain, select the Attributes tab, change the filter to Show only writable attributes and scroll down looking for something that doesn't have any data in it yet that might fit your data definition. Then, google that particular attribute name to see what the attribute's intended purpose is and as a sanity check to see if anything you use in your environment also uses it.

Related Topic