Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to write approximately 1000 - 5000 characters into a user property, but I'd prefer not to edit the schema rangeUpper attribute, or create one just for my purposes.

How should I research what user attributes I could repurpose for this? In other words, how can I export all properties available to an AD user and the corresponding rangeUpper value?

share|improve this question
2  
Out of curiosity what would you use a 5000 character field on a user for? –  Jim B Mar 30 '12 at 13:08
    
what are you trying to do shove "war and peace" into a users object? –  tony roth Mar 30 '12 at 15:36
    
@tonyroth The thumbnailPhoto attribute of my user object is a bit over 6200 [hex] characters. Does this count? It think OP's answer to Jim's question may help us understand. –  jscott Mar 30 '12 at 15:45
    
What I've seen before is that somebody was putting text into a user attribute that could have be more efficiently coded as a bitmap (don't confuse this with a graphic bitmap). In this one particular case he was putting in about 3000+ characters into each users attribute fields, I recoded it as a bitmap that took 9 bytes yet still contained the same info. Admittedly this was a stupid case but the idea is/was the same. –  tony roth Mar 30 '12 at 16:00
2  
It also just plain sounds like a bad idea. Finalize the schema then figure out how best to store it. There are likely to be fields that already exist to handle the data. –  Jim B Mar 30 '12 at 18:08
show 2 more comments

1 Answer

up vote 2 down vote accepted

The following PowerShell will look at the schema's user class, grab its allowedAttributes attribute, then look up the definition of each attribute and return its rangeUpper value.

# Need the Microsoft AD PS module
Import-Module ActiveDirectory

# Get the user class definition, include "allowedAttributes"
$userClass = Get-ADObject -SearchBase ((Get-ADRootDSE).schemaNamingContext) -Filter { Name -eq "User" } -Properties allowedAttributes

# Walk the allowedAttributes array and sort into a table with "name" and "rangeUpper"
$userClass.allowedAttributes | 
  ForEach-Object { Get-ADObject -SearchBase ((Get-ADRootDSE).schemaNamingContext) -Filter { LDAPDisplayName -eq $_ } -Property rangeUpper } |
    Sort-Object Name |
      Format-Table -Property Name, rangeUpper

# If you want to only see defined "rangeUpper" values
$userClass.allowedAttributes | 
  ForEach-Object { Get-ADObject -SearchBase ((Get-ADRootDSE).schemaNamingContext) -Filter { LDAPDisplayName -eq $_ } -Property rangeUpper } |
    Where-Object { $_.rangeUpper } |
      Sort-Object Name |
         Format-Table -Property Name, rangeUpper
share|improve this answer
    
This is fantastic! I don't see custom attribute #14 there, so perhaps that is implemented somewhere else? Or perhaps it is "Extension-Name"? –  makerofthings7 Mar 30 '12 at 16:36
    
@makerofthings7 ExtensionName is defined by the default AD schema. I suspect your custom attribute #14 has been added by a developer. Can you provide more details [edit your question] about this custom attribute? May need to poke some info/properties from it to determine how to proceed. –  jscott Mar 30 '12 at 17:18
    
Sure these custom attributes are added by Exchange and I think several of them are added during the default AD install. There are Custom Attributes 1 through 15. –  makerofthings7 Mar 30 '12 at 17:20
    
@makerofthings7 Are you referring to ms-Exch-Extension-Attribute-14 from the class ms-Exch-Custom-Attributes. Don't have Exchange, but let me test some things... –  jscott Mar 30 '12 at 17:53
    
I'd tend to shy away from any of the attributes named "ms-..." unless you know exactly why they are there and what they are used for. –  Jim B Mar 30 '12 at 18:10
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.