Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Is there a way to validate certain fields in Active Directory? For example, can we set something in AD so a user's phone number or other field/attribute must be complete before the account can be created. I'd like to know if we can do this as part of AD schema. I'm in a large organization and can't force everyone to use the same tool for account creation (or else I could build an account creation/mod tool and validate from the application.).

share|improve this question

2 Answers 2

That is actually an excellent question. This is a critical feature of "normal" databases, referred to as constraints. Without constraints, ensuring the integrity, accuracy, and quality of databases is more difficult and time consuming.

Some attributes are already configured this way. For example, the samAccountName must exist, and be unique within the domain.

I would recommend not changing a system attribute from optional to mandatory unless you are very comfortable with your Active Directory experience level, and have thoroughly tested in this in a non-production environment.

An alternative may be a scheduled task that scans objects for the fields where conformance is desired, and perform a regex to determine if they comply, and save that as a report for distribution to the team that would need to make any corrections.

If you're interested in the schema details and mandatory attributes, the following may be helpful:

How the Active Directory Schema Works
http://technet.microsoft.com/en-us/library/cc773309%28v=ws.10%29.aspx

Modify an existing schema class or attribute definition
http://technet.microsoft.com/en-us/library/cc757799%28v=ws.10%29.aspx

Understanding unique attributes in Active Directory
https://blogs.msdn.com/b/openspecification/archive/2009/07/10/understanding-unique-attributes-in-active-directory.aspx

Install the Active Directory Schema snap-in
http://technet.microsoft.com/en-us/library/cc755885%28v=ws.10%29.aspx

enter image description here

share|improve this answer
    
Excellent alternate suggestion. It should be very easy to whip this up in PowerShell. –  MDMarra Mar 2 '12 at 18:33

This is a classic example of looking for a technical solution to a NON-technical problem. If the admins can't follow guidelines on creating the accounts, remove their rights to do so.

Additionally, I don't believe you can configure an attribute to be required by a schema update. If someone has information how to do this, I will gladly stand corrected.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.