Windows 2003 SDKUser Object Attributes
A user object has multiple attributes. This section documents key attributes used by Windows, administrative tools, and the Windows Address Book (WAB). It does not describe all attributes; many attributes are not used for the user object.


Some attributes are stored in the directory, such as cn, nTSecurityDescriptor, objectGUID, and so on, and replicated to all domain controllers within a domain. A subset of these attributes is also replicated to the global catalog.

Non-replicated attributes are stored on each domain controller, but are not replicated elsewhere, such as badPwdCount, lastLogon, lastLogoff, and so on. The non-replicated attributes are attributes that pertain to a particular domain controller. For example, lastLogon is the last date and time that the user network logon was validated by the particular domain controller that is returning the property.

A user object also has constructed attributes that are not stored in the directory, but are calculated by the domain controller, such as canonicalName, distinguishedName, allowedAttributes, and so on.

Attributes for user objects are classified as:


Base Object Attributes
This category includes attributes required for all directory objects, such as objectClass, nTSecurityDescriptor, and so on.
Naming Attributes
This category includes attributes used to refer to or identify the object, such as distinguishedName, objectGUID, objectSID, and so on. For more information about naming attributes for user objects, see User Naming Attributes.
Security Attributes
This category includes attributes for logon and access control. For more information about security attributes for user objects, see User Security Attributes.
Address Book Attributes
This category includes attributes for e-mail and user data. For more information about address book attributes for user objects, see User Address Book Attributes.
Application Specific Attributes
This category includes user-specific configuration data for specific applications.

For more information about reading and modifying attributes for a user object, see Reading and Writing Attributes of Active Directory Objects.

For more information about the User class, including a complete list of the mayContain and mustContain attributes of the class, see User.


Setting Passwords

The password for a user cannot be modified directly because this would involve sending an unencrypted password over the network. To set the password for a user, it is necessary to use the IADsUser.ChangePassword or IADsUser.SetPassword method. The IADsUser.ChangePassword method is used when the application is allowing the user to change thier own password. The IADsUser.SetPassword method is used when the application enables an administrator to reset a password.

там жеUser Address Book Attributes
The address book attributes are used to provide supplementary identification and information for a user. Their content is defined by the user and the user's organization. These attributes can be viewed and managed by the Active Directory User and Computers snap-in or the Windows Address Book (WAB).

c The country/region in the user's address.
The country/region is represented as the two-character country/region code based on ISO-3166. For the valid codes, see Values for countryCode.

co The country/region in which the user is located.
notes A comment. This string can be a null string.
department The name for the department in which the user works.
description The description to display for the user.
displayName The name displayed in the address book for a particular user. This is usually the combination of the user's first name, middle initial, and last name.
directReports The list of users that directly report to the user. The users listed as reports are those that have the manager attribute set to this user. Each item in the list is a linked reference to the object that represents the user; therefore, Active Directory automatically updates this attribute when a user's manager attribute adds or removes this user as a manager. The items are represented as distinguished names.
facsimileTelephoneNumber The telephone number of the user's business fax machine.
givenName The given name (first name) of the user.
homePhone The primary home telephone number for the user.
initials The initials for parts of the user's full name. This may be used as the middle initial in the Windows Address Book.
ipPhone Used by Telephony.
l The locality, such as the town or city, in the user's address.
managedObjects The list of objects that are managed by the user. The objects listed are those that have the managedBy attribute set to this user. Each item in the list is a linked reference to the managed object; therefore, Active Directory automatically updates the managedObjects attribute when an object's managedBy attribute adds or removes this user as its manager. The items are represented as distinguished names.
manager The user who is the user's manager. The manager's user object contains a directReports attribute that contains references to all user objects that have their manager attribute set to the manager's user object.
mobile The primary cellular telephone number for the user.
otherFacsimileTelephoneNumber The list of telephone numbers of alternate fax machines for the user.
otherIpPhone Used by Telephony.
otherMobile The list of alternate cellular telephone numbers for the user.
otherPager The list of alternate pager telephone numbers for the user.
otherTelephone The list of alternate business telephone numbers for the user.
pager The primary pager telephone number for the user.
physicalDeliveryOfficeName The office location in the user's place of business.
postalAddress The user's postal address.
postalCode The postal code for the user's postal address. The postal code is specific to the user's country/region. In the United States of America, this attribute contains the ZIP code.
postOfficeBox The number or identifier of the user's post office box.
sn The user's surname (family name or last name).
st The state or province in the user's address.
street The street address of the user's place of business.
telephoneNumber The primary telephone number of the user's place of business.
title The user's job title. This attribute is commonly used to indicate the formal job title, such as Senior Programmer, rather than occupational class, such as programmer. It is not typically used for "suffix" titles such as Esq. or DDS.
Examples: Managing Director, Programmer II, Associate Professor, and Development Lead.

url The list of URLs for the user's alternate web pages.
wWWHomePage The URL for the user's primary web page.