Getting all possible classes / attributes for a AD Object

So in the World of the AD everything is build by classes. Classes are stored in the Schema part of the AD.

So what does this mean?

The fast basics

  • Each AD object has a objectClass which matches to a class in the schema.
  • Each class has a parent (subClassof)
  • One class has itself as its parent (top)
  • Each class has available attributes which might or must be set on an AD object.
  • An AD object can use all attributes of its class and all above it.

There are 4 attributes defined for each class which says which attributes it carries:

  • MayContain
  • MustContain
  • systemMayContain
  • systemMustContain

Lets get all classes that is assigned to a AD Object

For simplicity and to help everybody understand lets just use the Administrator. I have written a small script download adClassesOfAdministrator. Remember to rename it to ps1, since my WordPress thought ps1 was unsafe.

The output:

AD Classes rundown

Getting all attributes for the administrator account

So now that we know that which classes the Administrator account has the possibility of using, lets just see what attributes there are. So do you really want to walk through that by hand? Thought so, lets build another small adAttributesOnAdministrator:

AD Attributes on Administrator

So thats how you find all attributes that really exist. But not all are changeable by the users. Say for instance memberOf is a backlink from the groups members attribute.

Leave a Reply