# Export all AD attributes and default “Range Upper” size for the User class?

I need to write approximately 1000 - 5000 characters into a user property, but I'd prefer not to edit the schema rangeUpper attribute, or create one just for my purposes.

How should I research what user attributes I could repurpose for this? In other words, how can I export all properties available to an AD user and the corresponding rangeUpper value?

-
Out of curiosity what would you use a 5000 character field on a user for? –  Jim B Mar 30 '12 at 13:08
what are you trying to do shove "war and peace" into a users object? –  tony roth Mar 30 '12 at 15:36
@tonyroth The thumbnailPhoto attribute of my user object is a bit over 6200 [hex] characters. Does this count? It think OP's answer to Jim's question may help us understand. –  jscott Mar 30 '12 at 15:45
What I've seen before is that somebody was putting text into a user attribute that could have be more efficiently coded as a bitmap (don't confuse this with a graphic bitmap). In this one particular case he was putting in about 3000+ characters into each users attribute fields, I recoded it as a bitmap that took 9 bytes yet still contained the same info. Admittedly this was a stupid case but the idea is/was the same. –  tony roth Mar 30 '12 at 16:00
It also just plain sounds like a bad idea. Finalize the schema then figure out how best to store it. There are likely to be fields that already exist to handle the data. –  Jim B Mar 30 '12 at 18:08

The following PowerShell will look at the schema's user class, grab its allowedAttributes attribute, then look up the definition of each attribute and return its rangeUpper value.

# Need the Microsoft AD PS module
Import-Module ActiveDirectory

# Get the user class definition, include "allowedAttributes"
$userClass = Get-ADObject -SearchBase ((Get-ADRootDSE).schemaNamingContext) -Filter { Name -eq "User" } -Properties allowedAttributes # Walk the allowedAttributes array and sort into a table with "name" and "rangeUpper"$userClass.allowedAttributes |
ForEach-Object { Get-ADObject -SearchBase ((Get-ADRootDSE).schemaNamingContext) -Filter { LDAPDisplayName -eq $_ } -Property rangeUpper } | Sort-Object Name | Format-Table -Property Name, rangeUpper # If you want to only see defined "rangeUpper" values$userClass.allowedAttributes |
ForEach-Object { Get-ADObject -SearchBase ((Get-ADRootDSE).schemaNamingContext) -Filter { LDAPDisplayName -eq $_ } -Property rangeUpper } | Where-Object {$_.rangeUpper } |
Sort-Object Name |
Format-Table -Property Name, rangeUpper
-
This is fantastic! I don't see custom attribute #14 there, so perhaps that is implemented somewhere else? Or perhaps it is "Extension-Name"? –  makerofthings7 Mar 30 '12 at 16:36
@makerofthings7 ExtensionName is defined by the default AD schema. I suspect your custom attribute #14 has been added by a developer. Can you provide more details [edit your question] about this custom attribute? May need to poke some info/properties from it to determine how to proceed. –  jscott Mar 30 '12 at 17:18
Sure these custom attributes are added by Exchange and I think several of them are added during the default AD install. There are Custom Attributes 1 through 15. –  makerofthings7 Mar 30 '12 at 17:20
@makerofthings7 Are you referring to ms-Exch-Extension-Attribute-14 from the class ms-Exch-Custom-Attributes. Don't have Exchange, but let me test some things... –  jscott Mar 30 '12 at 17:53
I'd tend to shy away from any of the attributes named "ms-..." unless you know exactly why they are there and what they are used for. –  Jim B Mar 30 '12 at 18:10