Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are looking at putting photos in Active Directory. We have many domain controllers, some are in areas with not a lot of bandwidth. What are the recommend/max files sizes for photos or is this a bad idea to begin with. We are currently storing these in SharePoint and want to turn on the sync service to AD for profile photos.

My other thought was somehow telling AD to use SharePoint's storage for the photo but not sure if that's even possible.

How can I put staff photos in AD and mitigate as many replication / bandwidth issues as possible?

share|improve this question
I found an article saying 10KB but not sure if that means storage size or just for using the poweshell import: – Rob Mar 2 '12 at 21:21
If you have bandwidth issues, that's where DFS-R really shines. If you set up a namespace with a server at each location and reference that for the images, you should alleviate any bandwidth issues – Mark Henderson Mar 2 '12 at 22:05
Sth. slightly off topic: We once considered to add pictures of our employees to the AD too (and by that making them appear in Outlook/Exchange/Sharepoint and everywhere else). The outcome: The people found it very creepy to see their pics in a business environment. They are used to it in their private life, but got scared when it came about business.. – desasteralex Mar 2 '12 at 22:12

It's not a terrific idea for a couple of reasons. One of those reasons is that the photos are stored in the Active Directory database. So it doesn't matter if you host the photos on a DFS share with a DFS namespace or whatever. You convert the photo into bytes and store it in the "thumbnailPhoto" schema attribute of the user account object, therefore it directly increases the size (and therefore the replication load) of the Active Directory database.

Whatever the official max size is, you need to say WAY below that and keep the pictures absolutely as tiny as possible.

This Powershell code will update your thumbnailPhoto attribute.

Import-Module ActiveDirectory

$photo = [byte[]](Get-Content C:\photo.jpg -Encoding byte)

Set-ADUser user -Replace @{thumbnailPhoto=$photo}

Users do have access to modify their own thumbnailPhoto attribute by default. So you also need to be wary of abuse by end users. I was able to make this work with either a .bmp or a .jpg and I think a .png as well.

That will make the photo show up in your Exchange emails and such. But that doesn't replace the "user tile" that you see in you Windows 7 / 2008 R2 start menu, RDP logon dialog, etc. That is something separate.

Please see these posts for more detail on these two different types of account pictures:

Oh, and to answer your question, this blog post claims that the real size is 100KB and it has been since the attribute was introduced in Windows 2000:

One last thing -- there are other schema attributes that, well, don't do anything. They're vestigial I guess. Don't let them confuse you.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.