This seems completely unnecessary – surely you already know what attributes you already use for your Active Directory objects, right?
Well, not always. And why is it even important to know?
When working in large Active Directory environments, architecture and governance are often after-thoughts – and many of the largest Active Directory environments I’ve worked on suffer from this problem; which leads to a lack of formalised processes and documentation.
When you finally get around to writing that documentation, you will invariably need to answer questions like “when we create an object in AD, what attributes are mandetory and which are optional?”
So, here’s how I have reverse-engineered the in-use attributes, in order to write the governance around the creation of various object types (users vs computers vs groups etc).
The script below is for user accounts, and can be easily modified to check computer objects, groups and more.
Note: this is a pretty resource intensive script (pulling all attributes) and may take a long time if you have a very large number of objects.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 |
# Create an empty array to hold the results [System.Collections.ArrayList]$allproperties = @(); # Get all users and all properties $users= get-aduser -properties * -filter *; # Loop through all users foreach ($user in $users) { $availableproperties = $user.psobject.properties # Loop through all available properties foreach ($availableproperty in $availableproperties) { # Exclude non-attribute properties if (($availableproperty.name -ne "propertynames") -and ($availableproperty.name -ne "propertycount")) { # Exclude properties with empty or null values if (($availableproperty.value -ne $null) -and ($availableproperty.count -ne 0)) { # Add attribute name to results array $null = $allproperties.add($availableproperty.name) } } } } # Reduce list and display count by attribute name $allproperties | group -noelement | ft count, name -autosize |
Running the above script (on a very small scale) shows the attribute count, below, for 143 users.
As you can see, 143 out of 143 accounts have a whenCreated attribute set (obviously). But also, the three attributes highlighted stand out to me as “widely used” and worth documenting and standardising:
