How To Add Attribute Editor In Active Directory

The Active Directory Aspect Editor is a congenital-in graphical tool to manage the backdrop of AD objects (users, computers, groups). It is the Attribute Editor where you can view and change the values of Advertising object attributes that are non available in the object properties shown in the ADUC console.

Contents:

Attribute Editor in ADUC
Missing Attribute Editor Tab in Active Directory Search Results

If I'm non mistaken, the born Attribute Editor in Agile Directory appeared on Windows Server 2008 R2. Earlier, to edit the hidden properties of Advertisement objects you lot had to utilise a less convenient ADSI Edit tool.

Attribute Editor in ADUC

In order to use the Ad Attribute Editor, you must install the dsa.msc snap-in (ADUC — Active Directory Users and Computers).

Effort to open the properties of any user in AD. As you can see, some tabs with the user attributes are available. Hither are the primary of them:

General – the bones user backdrop that are set when an Advertisement account is created (first name, concluding name, phone number, email accost, etc.).
Address
Account – the account proper noun (samAccountName, userPrincipalName). Here you tin can specify the list of computers a user can log on to (LogonWorkstations), the options are: password never expires, user cannot change password, enabled/disabled account, the account expiration appointment, etc.
Profile – you tin can set a path to a user profile (in the scenario of roaming profiles), a logon script, a dwelling folder, a mapped network binder.
Telephones
Organization – task title, department, company, managing director proper name.

But the bones gear up of user properties is available to you in this window, but the User class in AD contains much more attributes (200+).

active directory user properties in aduc console

In order to display the advanced Attribute Editor, enable the option Advanced Features in the ADUC View card.

enable Advanced Features in ADUC snap-in

Then open the user properties over again and note that a split Aspect Editor tab has appeared. If you lot switch to information technology, the Advertising user Attribute Editor volition open. You can see the list of all user attributes and their values in the table form. You can click whatsoever attribute to change its value. For example, if you lot modify the value of the section aspect, you volition see that the name of the department in the Organization tab of user properties has also changed.

Active Directory Attribute Editor in ADUC

In the Attribute Editor, you lot can copy the distinguishedName value (in this format: CN=Jon Brion,OU=Users,OU=California,OU=U.s.,DC=woshub,DC=com — a unique object name in Ad), find the engagement when the business relationship was created (whenCreated), etc.

At that place is the Filter button at the bottom of the Advertising Attribute Editor. By default, empty object attributes are not displayed in the attribute window (the Show simply attributes that have values selection is checked). If you uncheck it, all attributes of the User class volition exist shown in the editor console. Delight notation the Bear witness only writable attributes option. If you enable it, only the attributes you are delegated the edit permissions on will be shown (if you do not have the alter permissions on the attributes of this user, the list of attributes will exist empty).

attribute editor filter: show only writable attributes

empty user attribute list in aduc

Most AD attributes have the integrated value decoding feature. For example:

Missing Attribute Editor Tab in Active Directory Search Results

The master disadvantage of the AD Attribute Editor is that information technology won't open in the object properties if you have constitute it using Active Directory search. To use the Attribute Editor, must expand the OU that contains the object you need in the Ad tree, find the object and open up its properties (information technology is very inconvenient).

I have institute a lifehack that allows to open up the Attribute Editor for the user if you constitute an account through a search in the ADUC panel.

So:

Use the search to find the user you demand;
Go to the tab with the list of user groups (Member of);
Open up one of the groups (it is better that it contained as few users every bit possible);
In the group backdrop, go to the Members tab and shut (!) the user properties window;
And so click the user you need in the list of group members and the user backdrop window with the Aspect Editor tab will announced.

You can also open up the Attribute Editor using the Active Directory saved queries. For example, you can utilize the following query to discover a user: (objectcategory=person)(samaccountname=*andrey*)

AD Saved queries

Or you tin use the new Active Directory Administrative Heart where the Attribute Editor tab of a user (or a computer) is available even for the search results (check the Extension tab).

User's Attribute Editor in Active Directory Administrative Center

To view and edit all attributes of users, groups or computers in Advertizement you can employ PowerShell cmdlets from RSAT-Ad-PowerShell module instead of the Aspect Editor.

To view the values of all object attributes:

of a user: Get-ADUser username -Properties *
of a computer: Get-ADComputer computername -Backdrop *
of a group: Get-ADGroup groupname -Properties *

To modify object attributes in AD, the Set-ADUser, Prepare-ADComputer and Set-ADGroup cmdlets are used respectively.