Combined index and DN. Multiple indices are only possible when a column is set to SplitDataByRow.

The full distinguished name.

The relative distinguished name.

The base distinguished name.

The list of classes from which this class is derived.

This attribute contains the family or last name for a user.

The name that represents an object. Used to perform searches.

The user's password in UTF-8 format. This is a write-only attribute.

The primary telephone number.

List of distinguished names that are related to an object.

Contains the description to display for an object. This value is restricted as single-valued for backward compatibility in some cases but is allowed to be multi-valued in others. See Remarks.

Contains the user's job title. This property is commonly used to indicate the formal job title, such as Senior Programmer, rather than occupational class, such as programmer. It is not typically used for suffix titles such as Esq. or DDS.

The X.121 address for an object.

Specifies a mnemonic for an address associated with an object at a particular city location. The mnemonic is registered in the country/region in which the city is located and is used in the provision of the Public Telegram Service.

This is part of the X.500 specification and not used by NTDS.

The X.500-preferred way to deliver to addressee.

A list of alternate telex numbers.

Specifies the Teletex terminal identifier and, optionally, parameters, for a teletex terminal associated with an object.

Specifies an International ISDN Number associated with an object.

Contains telephone number of the user's business fax machine.

The street address.

The post office box number for this object.

The postal or zip code for mail delivery.

The mailing address for the object.

Contains the office location in the user's place of business.

The name of the organizational unit.

The name of a user's state or province.

Represents the name of a locality, such as a town or city.

Contains the DER-encoded X.509v3 certificates issued to the user. Note that this property contains the public key certificates issued to this user by Microsoft Certificate Service.

The TCP/IP address for a network segment. Also called the subnet address.

Flags that control the behavior of the user account.

The number of times the user tried to log on to the account using an incorrect password. A value of 0 indicates that the value is unknown.

Specifies the code page for the user's language of choice. This value is not used by Windows 2000.

The home directory for the account. If homeDrive is set and specifies a drive letter, homeDirectory must be a UNC path. Otherwise, homeDirectory is a fully qualified local path including the drive letter (for example, DriveLetter:\Directory\Folder). This value can be a null string.

Specifies the drive letter to which to map the UNC path specified by homeDirectory. The drive letter must be specified in the form DriveLetter: where DriveLetter is the letter of the drive to map. The DriveLetter must be a single, uppercase letter and the colon (:) is required.

The last time and date that an attempt to log on to this account was made with a password that is not valid. This value is stored as a large integer that represents the number of 100-nanosecond INTEGERs since January 1, 1601 (UTC). A value of zero means that the last time a incorrect password was used is unknown.

This attribute is not used.

The last time the user logged on. This value is stored as a large integer that represents the number of 100-nanosecond INTEGERs since January 1, 1601 (UTC). A value of zero means that the last logon time is unknown.

The account's LAN Manager password.

This attribute contains a list of locale IDs supported by this application. A locale ID represents a geographic location, such as a country/region, city, county, and so on.

This attribute specifies the path for the user's logon script. The string can be null.

The hours that the user is allowed to logon to the domain.

This attribute is not used. See the User-Workstations attribute.

The maximum amount of disk space the user can use. Use the value specified in USER_MAXSTORAGE_UNLIMITED to use all available disk space.

Contains the NetBIOS or DNS names of the computers running Windows NT Workstation or Windows 2000 Professional from which the user can log on. Each NetBIOS name is separated by a comma. Multiple names should be separated by commas.

The password of the user in Windows NT one-way format (OWF). Windows 2000 uses the Windows NT OWF. This property is used only by the operating system. Note that you cannot derive the clear password back from the OWF form of the password.

Non-Windows NT or LAN Manager workstations from which a user can log on.

The password history of the user in Windows NT one-way format (OWF). Windows 2000 uses the Windows NT OWF.

The date and time that the password for this account was last changed. This value is stored as a large integer that represents the number of 100 nanosecond INTEGERs since January 1, 1601 (UTC). If this value is set to 0 and the User-Account-Control attribute does not contain the UF_DONT_EXPIRE_PASSWD flag, then the user must set the password at the next logon.

The Organizational Unit to show by default on user' s desktop.

Contains the relative identifier (RID) for the primary group of the user. By default, this is the RID for the Domain Users group.

Parameters of the user. Points to a Unicode string that is set aside for use by applications. This string can be a null string, or it can have any number of characters before the terminating null character. Microsoft products use this member to store user data specific to the individual program.

Specifies a path to the user's profile. This value can be a null string, a local absolute path, or a UNC path.

Operator count.

Indicates that a given object has had its ACLs changed to a more secure value by the system because it was a member of one of the administrative groups (directly or transitively).

The date when the account expires. This value represents the number of 100-nanosecond INTEGERs since January 1, 1601 (UTC). A value of 0 or 0x7FFFFFFFFFFFFFFF (9223372036854775807) indicates that the account never expires.

The password history of the user in LAN Manager (LM) one-way format (OWF). The LM OWF is used for compatibility with LAN Manager 2.x clients, Windows 95, and Windows 98.

Windows NT Security. Down level Windows NT support.

The number of times the account has successfully logged on. A value of 0 indicates that the value is unknown.

Used by DS Security to determine which users can perform specific operations on the host object.

The default Class Store for a given user.

The Groups-to-Ignore attribute is not currently used.

The Group-Priority attribute is not currently used.

The location of the desktop profile for a user or group of users. Not used.

DNS name of server handing dynamic properties for this account.

This attribute contains the UPN that is an Internet-style login name for a user based on the Internet standard RFC 822. The UPN is shorter than the distinguished name and easier to remember. By convention, this should map to the user email name. The value set for this attribute is equal to the length of the user's ID and the domain name. For more information about this attribute, see User Naming Attributes.

The date and time (UTC) that this account was locked out. This value is stored as a large integer that represents the number of 100-nanosecond INTEGERs since January 1, 1601 (UTC). A value of zero means that the account is not currently locked out.

Specifies a UNC path to the user's shared documents folder. The path must be a network UNC path of the form \\Server\Share\Directory. This value can be a null string.

Specifies a UNC path to the user's additional shared documents folder. The path must be a network UNC path of the form \\Server\Share\Directory. This value can be a null string.

List of principal names used for mutual authentication with an instance of a service on this computer.

String name of an ACS policy that applies to this user.

Opaque data used by the Windows NT terminal server.

This attribute contains a number of certificates. A user can generate a certificate per computer. For each certificate we also keep a digest.

An array of digests of the corresponding certificates in attribute mSMQ-Sign-Certificates. They are used for mapping a digest into a certificate.

In MSMQ mixed-mode, contains the previous value of mSMQDigests.

In MSMQ mixed-mode, the attribute contains the previous value of mSMQSignCertificates. MSMQ supports migration from the MSMQ 1.0 DS to the Windows 2000 DS, and mixed mode specifies a state in which some of the DS severs were not upgraded to Windows 2000.

Indicates whether the account has permission to dial in to the RAS server. Do not modify this value directly. Use the appropriate RAS administration function to modify this value.

The msNPCallingStationID attribute is used internally. Do not modify this value directly.

The msNPSavedCallingStationID attribute is used internally. Do not modify this value directly.

The msRADIUSCallbackNumber attribute is used internally. Do not modify this value directly.

The msRADIUSFramedIPAddress attribute is used internally. Do not modify this value directly.

The msRADIUSFramedRoute attribute is used internally. Do not modify this value directly.

The msRADIUSServiceType attribute is used internally. Do not modify this value directly.

The msRASSavedCallbackNumber attribute is used internally. Do not modify this value directly.

The msRASSavedFramedIPAddress attribute is used internally. Do not modify this value directly.

The msRASSavedFramedRoute attribute is used internally. Do not modify this value directly.

The security ID of the creator of the object that contains this attribute.

Defines the LDAP filter explicitly, overriding any other values set in the WHERE clause.