miker/Compose-Files
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

migrate

Browse Source
This commit is contained in:
Mike McFetridge
2026-07-20 09:23:17 -04:00
parent c1315882da
commit 72272e4006
3179 changed files with 562960 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Backups/Miker/.trash/Information AD Attributes.md
+296
View File
@@ -0,0 +1,296 @@
**Table of Contents**
OVERVIEW
ATTRIBUTE MAP
Users
Groups
ABOUT THE WEB TELE PROCESS
# OVERVIEW
## Active Directory Object Attributes
There are several ways to report details/attributes from AD.  You may want a report of users with their org code, email address, and phone number.  To do this you can:
 
1. Using ADUC you can create a query.  Go to the Saved Queries section of ADUC and create a new one.  You can use a custom search and build a condition list or even LDAP (more difficult because you have to know a bit more).  With this output you can right click and chose to export to a tab delimited file.  You may want the report to list additional details and you'll have the major ones but not all of them.  Note:  The query can be built using any available attribute but the report will only be able to list a small subset.
2. Best: Many folks in WSG can run Powershell reports with whatever criteria is appropriate.
3. Best: Talk to Ben about an existing report for regular, -D and -M accounts using Powershell.
In some cases the info returned will need to be converted to be readable.  Commonly the date/time stamps.  If so, use this since it will convert the date/time:
- In Excel you can use the formula:  =IF(J2\>0,J2/(8.64*10^11) - 109205,"")       Replace J2 with the corresponding cell. 
- insert a column (to the left or right of lastlogon and lastlogontimestamp  columns 
- select column  -- format cells -- change type to the last Time type (ie. 3/14/01 13:30)
- copy in formula (above) and update column names (i.e lastlogon and lastlogontimestamp)
- Drag down formula to end of sheet
- Select column and copy then “paste special” selecting “values” (do this for each column to modify)
- Erase original lastlogon and lastlogontimestamp columns that contain the scientific notation
- In powershell use an expression in a Select-Object pipe (excerpt): 
@{n="lastLogonDate";e={If ($_.lastLogonTimestamp -eq $null) {"Never"} ELSE {[datetime]::FromFileTime($_.lastLogonTimestamp)}}}
## ATTRIBUTE MAP (data dictionary)
## User Objects
What data does all of the attributes contain?  Some of them are self-explanatory like displayName.  Most cannot be written directly because automation populates the details.  Here are the attributes that may not be self-explanatory:
- **altSecurityIdentities**:  AKA 'AltSecID' is the attribute used to map a user PIV to the AD account.  This is automated based on specific criteria:
- AD UPN before the @ is numeric
- UPN before the @ is 10-digits
- UPN after the @ is cbp.dhs.gov
- DHSAttribute13 attribute is blank/null (if not null, automation assumes a non-CBP PIV and leaves AltSecID alone)
- **Company:** The company attribute is written by Webtele. Written by svc-webtele-proc
- **Department**:  The department description from Webtele. Written by svc-webtele-proc
- The following attributes belong to DHS and should not be modified by CBP unless for the documented purpose:
- DHSAttribute1 not documented
- DHSAttribute2 not documented
- DHSAttribute3 not documented
- DHSAttribute4 not documented
- DHSAttribute5 not documented
- DHSAttribute6 not documented
- DHSAttribute7 not documented
- DHSAttribute8 not documented
- DHSAttribute9 not documented
- DHSAttribute10 not documented
- DHSAttribute11 not documented
- DHSAttribute12 not documented
- DHSAttribute13:  used to denote the user's PIV user principal name (aka UPN).  The value found on the PIV/CAC user principal name.
- It is not typically used unless the user holds a non-CBP PIV/CAC (i.e. DHS HQ, USCG). 
- Using a CBP user's PIV UPN, while not required, will not cause any problems.
- Populating this with the user's PIV UPN causes AltSecID automation to ignore the account. This can be useful when the user's AltSecID needs to be unique / manually populated.
- DHSAttribute14 not documented
- DHSAttribute15 not documented
- DHSAttribute16 not documented
- DHSAttribute17 not documented
- DHSAttribute18 not documented
- CDHSAttribute20: not documented
- Extension Attributes
- **extensionAttribute1**:  Employe Series Sailpoint is pushing this to AD at 3AM using AD\SVC-EDME-ICAM-USRMNT.
- **extensionAttribute2:** ==Unused==
- **extensionAttribute3**: Employee GRADE (i.e. GS level ) and pushed to AD via Sailpoint. Assigned 8/30/19. As of 10/1/19 Sailpoint is pushing this to AD at 3AM using AD\SVC-EDME-ICAM-USRMNT.
- **extensionAttribute4**:  is the Organizational code from Webtele.  Everyone in AD should have one but some contractors do not because they are not adequately documented.  The first two numbers identify the office like Border Patrol, OFO, ES/OIT, etc. Written by svc-webtele-proc. Glen Corcoran BEMSD should have the org code definitions. The top level organizations are denoted by first 2 digits:
| | | |
|---|---|---|
|**ORG CODE**|**SHORT TITLE**|**LONG TITLE**|
|0100000000000000|OFFICE OF THE COMMISSIONER|OFFICE OF THE COMMISSIONER|
|0200000000000000|OFFICE OF THE CHIEF COUNSEL|OFFICE OF THE CHIEF COUNSEL|
|1200000000000000|OFFICE OF CONGRESSIONAL AFFAIR|OFFICE OF CONGRESSIONAL AFFAIRS|
|1900000000000000|OFFICE OF PUBLIC AFFAIRS|OFFICE OF PUBLIC AFFAIRS|
|2400000000000000|OFFICE OF TRADE|OFFICE OF TRADE|
|2600000000000000|OPR-OF PROFESSNL RSPNSIBILTY|OFFICE OF PROFESSIONAL RESPONSIBILITY|
|3500000000000000|U.S. BORDER PATROL|U.S. BORDER PATROL|
|3600000000000000|OFF OF FIELD OPS|OFFICE OF FIELD OPERATIONS|
|3800000000000000|OFC AIR & MARINE OPS|OFFICE OF AIR AND MARINE OPERATIONS|
|3900000000000000|OPERATIONS SUPPORT OFFICE|OPERATIONS SUPPORT OFFICE|
|4200000000000000|ENTERPRISE SERVICES OFFICE|ENTERPRISE SERVICES OFFICE|
|4300000000000000|OFFICE OF FINANCE|OFFICE OF FINANCE|
|4400000000000000|OFFICE OF INTELLIGENCE|OFFICE OF INTELLIGENCE|
(Last confirmed 12/15/22 with Denise Brewer)
This section expands org code a bit into office level organizations:
- **extensionAttribute5:**  Supervisor Code Webtele updates this attribute (1-8) svc-webtele-proc (on all users). Webtele consumes from SAP BEAR
- **extensionAttribute6:**  ==Unused==
- **extensionAttribute7:**  A NULL or any other value will Synch to Azure\O365 Automatically for User objects
A value of "o365nosync" will filter the user's identity from synching to the Azure AD (Office 365) cloud.  This value must be cleared if you wish to again sync the AD user identity to Office 365.
- **extensionAttribute8:**  Requested by CBP email engineering August 2019. Utilized by the email creation script to assign a primary email address to the proper realm for new mailboxes. Valid entries CTR, GOV, MIL, OGA, or FSN
- **extensionAttribute9**:  Denotes GOVERNMENT or CONTRACTOR. Updated by Webtele (svc-webtele-proc) "SAP BEAR feed" This attribute is used by dynamic distribution groups and Other System queries.
- **extensionAttribute10** is not documented but contains [first.mi.last@dhs.gov](mailto:first.mi.last@dhs.gov) . Only a fraction of users have this attribute. Appears unused since 2018.
- **extensionAttribute11** is to mark how and AD objects O365 mailbox should be provisioned: Calendar, Resource, Shared. Will be manually set by the TSD upon AD object creation. Once marked, ESG email automation will provision accordingly. [Requested by John Petz 1/22/19]
- **extensionAttribute12** tracks user mailbox migration state. This attribute is being updated by an Orchestrator automation that is monitoring the status of the mailbox copy and required post processing actions to execute after the copy is complete. [Requested by John Petz 1/22/19]
- **extensionAttribute13** contains the user's CanonicalName. Used for Exchange Query Based Distribution lists. Account SVC-EDME-EXCHAUTO updates this attribute. Orchestrator runbook EDME\Office 365\Exchange\Update EA13 Attribute. [Requested by John Petz 1/22/19]
- **extensionAttribute14** ==Unused== (Kellerman cleaned up pre EaaS info like "NWG-EXMB-A-027 SG1_DB12" on 5/27/20)
- **extensionAttribute15** used for Employee Status based (Currently SailPoint Separation. [Requested by ICAM 6/26/19]
- Other Attributes
- **L** denotes the user's city as synchronized from Webtele
- **ipPhone:** Used by Unified Communication as a Service (UCaaS) Joe Marsten POC: Updated manually by TSD?
- **mail:**  this is the primary SMTP address of the user. It is synchronized by EaaS. 
- **Manager:** Since June 2019 the manager attribute is written from a Sailpoint database. The manager attribute is taken from various sources depending on the user (Tele for contractors, HRBE for feds).  AD\SVC-EDME-ICAM-USRMNT has been delegated to write this attribute. The manager attribute is a distinguished name of the user's manager.
- **mobile**:  user's mobile telephone number from Webtele
- **Info**: AKA "Telephone Notes" is unused. It used to contain a user's Blackberry pin until December 2022 when it was cleared by Kellerman.
- **msRTCSIP-PrimaryUserAddress**:  The user's SIP address used by messaging apps. This may not be used now that Skype is gone and Office 365 hosts the Teams service. It used to be synchronized from the DSA domain and is no longer.
- **postalCode**:  the user's zip code from Webtele. Written by svc-webtele-proc
- **st**:  State according to Webtele. Written by svc-webtele-proc
- **streetAddress:** Street address from Webtele. Written by svc-webtele-proc
- **telephoneNumber** according to Webtele
- **title**:  The user's Title according to Webtele
- **userPrincipalName**: This value is shown / modified through the ADUC 'Account' tab only. For CBP users it must be the 10-digit [EDIPI@cbp.dhs.gov](mailto:EDIPI@cbp.dhs.gov) (**E**lectronic **D**ata **I**nterchange **P**ersonal **I**dentifier). This is the key to AltSecID automation, along with the user's email address.
**OIT DAC Software**
| | |
|---|---|
|421100021*|PSPD - Passenger|
|421100022*|TASPD - Targeting|
|421100023*|CSPD - Cargo|
|421100024*|BEMSD - Border Enforcement|
**OIT DAC Infrastructure**
| | |
|---|---|
|421100030*|ECSD - Cloud Services|
|421100031*|EIOD - Infrastructure|
|421100032*|FSD - Field Support (1 of 2)|
|421100033*|FSD - Field Support (2 of 2)|
**OIT Direct reports to OIT AC**
| | |
|---|---|
|42110004*|CSD - Cybersecurity|
|421100010*|CTO - Technology|
**Other ES Offices**
| | |
|---|---|
|4204*|OHRM - Office of Human Resources Management|
|4205*|OTD - Office of Trade and Development|
|4206*|OFAM - Office of Facilities and Asset Management|
|4208*|ES Office of Acquisition|
ADUC MAP
**General Tab**
| | | |
|---|---|---|
|**Friendly Name**|**Attribute Name**|**Example**|
|First Name|givenName|John|
|Initials|initials|JS|
|Last Name|sn|Smith|
|Display Name|displayName|Smith , John|
|Description|description|Sales Manager|
|Office|physicalDeliveryOfficeName|London Office|
|Telephone Number|telephoneNumber|949-555-1234|
|E-mail-Addresses|mail|JSmith@domain.com|
|Common Name|CN|John Smith|
**Address Tab**
| | | |
|---|---|---|
|**Friendly Name**|**Attribute Name**|**Example**|
|Street|streetAddress|10 The Road|
|PO Box|postOfficeBox|Po Box 1|
|City|l _(Lowercase L)_|NewLondon|
|State/Province|st|New York|
|Zip/Postal Code|postalCode|61441|
|Country Name|c|GB, DE, US etc|
**Group Tab**
| | | |
|---|---|---|
|**Friendly Name**|**Attribute Name**|**Example**|
|Group|memberOf|CN=Managers,OU=Sales,DC=Domain,DC=Com|
**Account Tab**
| | | |
|---|---|---|
|**Friendly Name**|**Attribute Name**|**Example**|
|User Logon Name|userPrincipalName|[9999999999@cbp.dhs.gov](mailto:%209999999999@cbp.dhs.gov)|
|User Logon Name (Pre W2K)|sAMAccountName|[hash]|
**Telephones Tab**
| | | |
|---|---|---|
|**Friendly Name**|**Attribute Name**|**Example**|
|Home (Other)|otherHomePhone|Not Set|
|Pager|pager|949-555-1234 (Cell Number)|
|Pager (Other)|otherPager|Not Set|
|Mobile|mobile|Not Set|
|Mobile (Other)|otherMobile|Not Set|
|Fax|facsimileTelephoneNumber|Not Set|
|Fax (Other)|otherFacsimile|Not Set|
|Telephone Number|telephoneNumber|Not Set|
|IP Phone|ipPhone|949-555-1234|
|IP Phone (Other)|otherIpPhone|Not Set|
|Notes|info|Not Set|
**Organization Tab**
| | | |
|---|---|---|
|**Friendly Name**|**Attribute Name**|**Example**|
|Title|title|Manager|
|Department|department|Sales|
|Company|company|Big Corp|
|Manager|manager|CN=SJobs,OU=Managers,DC=Domain,DC=Com|
|Employee ID|employeeID|Not Set|
|Employee Type|employeeType|Not Set|
|Employee Number|employeeNumber|Not Set|
|Car License|carLicense|Not Set|
|Division|division|Not Set|
|Room Number|roomNumber|Not Set|
 
 
## Group Objects
This section documents attributes specific to group objects.
ExtensionAttributes 2-4 and 11-15 are reserved for Privileged Access and EDME \ICAM Sailpoint management
- **extensionAttribute7:**  Group Objects DO NOT Automatically sync to Azure AD (Office 365) cloud. 
This value must be “synco365” to synch to Azure AD (Office 365)
- **extensionAttribute2  Sailpoint: 1st** APP-APPROVER **Group name**
- **extensionAttribute4 Sailpoint:** APPOWNER_SUPER_APPROVER Group name
- **extensionAttribute10 Sailpoint: Denotes Numerical Value of available licenses for Software associated groups**
- **extensionAttribute11  Sailpoint: Denotes Privileged Access if "TRUE"**
- **extensionAttribute12  Sailpoint: Denotes The Server Admin Group targets and clarifies it grants Admin to ALL Servers in All the subordinate OUs when set to "TRUE"**
- **extensionAttribute14 Sailpoint: Application Name/Project name**
# About the WebTele Process
The following information was supplied by the WebTele team, Ken Mak. Account svc-webtele-proc writes these details.
| | | | | |
|---|---|---|---|---|
|**WT Field Description**|**WT Table:Field**|**AD Value**|**AD Logic**|**AD dataflow**|
|Country - (country code): 2-digit|LOC: CTRY_CD|c|WT updates to AD every 4 min if changed in WT|WT sync pushes to AD|
|Agency code: always set to "CU"; we only pull CBP orgs from COMS table|ORG: AGNC_CD|company, DHSAttribute19|is written as "CBP" when new shell record is created... and whenever WT updates every 4 minutes if there is a change in the record,  DHSAttribute19 is set to value "1" (we only read it) if isDHS|WT sync pushes to AD|
|Short name: used as display name in WT|ORG: SHRT_NM|department|WT pulls from AD every 24 hrs(@ 9am) for new record, new active, WT updates to AD every 4 min if changed in WT|WT sync pushes to AD;#WT sync pulls from AD|
|Organization code (16 digit org code) NOTE: it is not a key to the org table|EMPLOYEE: ORG_ID_CD|extensionAttribute4|WT pulls from AD every 24 hrs(@ 9am) for new record, new active will put in all zeros if missing. , WT pushes to AD every 4 min if changed.|WT sync pushes to AD;#WT sync pulls from AD|
|Supervisor type code: none/not specified = 0, supervisor/manager = 2(used), supervisor = 4, management official = 5, leader = 6, team leader = 7, other = 8|EMPLOYEE: SupervisorType|extensionAttribute5|WT updates to AD every 4 min if changed in WT|WT sync pushes to AD|
|Contractor or government indicator <br>1= Is CBP/ Is federal employee/ Is government <br>0= contractor|EMPLOYEE: USCS_EMP_ACTV|extensionAttribute9|WT pulls from AD every 24 hrs(9am) if new or reactivated, WT pushes to AD every 4 min if changed.|WT sync pushes to AD;#WT sync pulls from AD|
|FAX number  (official tab) (PHN_IND=9)|PHONE: PHN_NBR|facsimileTelephoneNumber|WT pulls from AD every 24 hrs(@ 9am) for new record, new active WT updates to AD every 4 min if changed in WT|WT sync pushes to AD;#WT sync pulls from AD|
|First Name|EMPLOYEE: FRST_NM|givenName|WT pulls from AD every 24 hrs(@ 9am) for new record, new active|WT sync pulls from AD|
|City Name|LOC: CITY_NM|l (lower case L)|WT updates to AD every 4 min if changed in WT|WT sync pushes to AD|
|Official Email address [*.cbp.dhs.gov] (ADDR_IND=3)|EMAIL: NTRNT_ADDR:3|mail|Pulls every 24 hrs, AD to WT, (we only read from AD and write to WT the official (indicator 3), will overwrite old if has changed )|WT sync pulls from AD|
|Mobile Number (official tab)  (PHN_IND=3)|PHONE: PHN_NBR:3|mobile|WT pulls from AD every 24 hrs(@ 9am) for new record, new active WT updates to AD every 4 min if changed in WT|WT sync pushes to AD;#WT sync pulls from AD|
|Pager number code (official tab)  (PHN_IND=6)|PHONE: PHN_NBR|pager|WT pulls from AD every 24 hrs(@ 9am) for new record, new active WT updates to AD every 4 min if changed in WT|WT sync pulls from AD;#WT sync pushes to AD|
|Room number|EMPLOYEE: RM_NBR|physicalDeliveryOfficename|WT updates AD every 4 min if changed concatenated with other office room number and cube|WT sync pushes to AD|
|Room or cube number (updated by WMD/OIT or the user)|EMPLOYEE: RMT_BIN_NBR|physicalDeliveryOfficename|WT updates AD every 4 min if changed concatenated with other office room number and cube|WT sync pushes to AD|
|ZIP CODE|LOC: PSTL_CD|postalCode|WT updates to AD every 4 min if changed in WT|WT sync pushes to AD|
|Alias Email address comma separated [*.cbp.dhs.gov] (ADDR_IND=5)|EMAIL: NTRNT_ADDR:5|proxyAddresses|Pulls every 24 hrs, AD to WT, (we only read from AD and write to WT the official (indicator 3), will overwrite old if has changed )|WT sync pulls from AD|
|HashId (key)|EMPLOYEE: EMP_ID_NBR|sAMAccountName|HashID is a unique identifier for AD, WT sync reads AD every 24 hours at 9AM, new records are created using this AD field as the HashID key|WT sync pulls from AD|
|Last Name|EMPLOYEE: LST_NM|sn|WT pulls from AD every 24 hrs(@ 9am) for new record, new active|WT sync pulls from AD|
|State CODE - from location as shown on the public tab derived from TRIRIGA|LOC: ST_CD|st|WT updates to AD every 4 min if changed in WT|WT sync pushes to AD|
|Street Address as shown on the public tab derived from TRIRIGA list - street address 1 (primary)|LOC: STR_1_ADDR|streetAddress|WT updates to AD every 4 min if changed in WT|WT sync pushes to AD|
|Office number code (public tab)  (PHN_IND=2)|PHONE: PHN_NBR|telephoneNumber|WT pulls from AD every 24 hrs(@ 9am) for new record, new active WT updates to AD every 4 min if changed in WT|WT sync pushes to AD;#WT sync pulls from AD|
|Employee title (for government is pulled by HRBE for contractor by Supervisor or Admin)|EMPLOYEE: TITL_TXT|title|WT pulls from AD every 24 hrs(@ 9am) for new record, new active WT updates to AD every 4 min if changed in WT|WT sync pushes to AD;#WT sync pulls from AD|
|Employee status (1= active, 0 = inactive)|EMPLOYEE: STUS_CD|userAccountControl|WT pulls from AD every 24 hrs(@ 9am) for new record, new active|WT sync pulls from AD|