miker/Compose-Files
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
main
Compose-Files/Backups/Miker/.trash/Information AD Attributes.md
T
Mike McFetridge 72272e4006 migrate
2026-07-20 09:23:17 -04:00

19 KiB
Raw Permalink Blame History

Table of Contents
OVERVIEW
ATTRIBUTE MAP
Users
Groups
ABOUT THE WEB TELE PROCESS

OVERVIEW

Active Directory Object Attributes

There are several ways to report details/attributes from AD.  You may want a report of users with their org code, email address, and phone number.  To do this you can:
 

  1. Using ADUC you can create a query.  Go to the Saved Queries section of ADUC and create a new one.  You can use a custom search and build a condition list or even LDAP (more difficult because you have to know a bit more).  With this output you can right click and chose to export to a tab delimited file.  You may want the report to list additional details and you'll have the major ones but not all of them.  Note:  The query can be built using any available attribute but the report will only be able to list a small subset.
  2. Best: Many folks in WSG can run Powershell reports with whatever criteria is appropriate.
  3. Best: Talk to Ben about an existing report for regular, -D and -M accounts using Powershell.

In some cases the info returned will need to be converted to be readable.  Commonly the date/time stamps.  If so, use this since it will convert the date/time:

  • In Excel you can use the formula:  =IF(J2>0,J2/(8.64*10^11) - 109205,"")       Replace J2 with the corresponding cell. 

    • insert a column (to the left or right of lastlogon and lastlogontimestamp  columns 
    • select column  -- format cells -- change type to the last Time type (ie. 3/14/01 13:30)
    • copy in formula (above) and update column names (i.e lastlogon and lastlogontimestamp)
    • Drag down formula to end of sheet
    • Select column and copy then “paste special” selecting “values” (do this for each column to modify)
    • Erase original lastlogon and lastlogontimestamp columns that contain the scientific notation

  • In powershell use an expression in a Select-Object pipe (excerpt): 

@{n="lastLogonDate";e={If ($.lastLogonTimestamp -eq $null) {"Never"} ELSE {[datetime]::FromFileTime($.lastLogonTimestamp)}}}

ATTRIBUTE MAP (data dictionary)

User Objects

What data does all of the attributes contain?  Some of them are self-explanatory like displayName.  Most cannot be written directly because automation populates the details.  Here are the attributes that may not be self-explanatory:

  • altSecurityIdentities:  AKA 'AltSecID' is the attribute used to map a user PIV to the AD account.  This is automated based on specific criteria:

    • AD UPN before the @ is numeric
    • UPN before the @ is 10-digits
    • UPN after the @ is cbp.dhs.gov
    • DHSAttribute13 attribute is blank/null (if not null, automation assumes a non-CBP PIV and leaves AltSecID alone)

  • Company: The company attribute is written by Webtele. Written by svc-webtele-proc

  • Department:  The department description from Webtele. Written by svc-webtele-proc

  • The following attributes belong to DHS and should not be modified by CBP unless for the documented purpose:

    • DHSAttribute1 not documented

    • DHSAttribute2 not documented

    • DHSAttribute3 not documented

    • DHSAttribute4 not documented

    • DHSAttribute5 not documented

    • DHSAttribute6 not documented

    • DHSAttribute7 not documented

    • DHSAttribute8 not documented

    • DHSAttribute9 not documented

    • DHSAttribute10 not documented

    • DHSAttribute11 not documented

    • DHSAttribute12 not documented

    • DHSAttribute13:  used to denote the user's PIV user principal name (aka UPN).  The value found on the PIV/CAC user principal name.

      • It is not typically used unless the user holds a non-CBP PIV/CAC (i.e. DHS HQ, USCG). 
      • Using a CBP user's PIV UPN, while not required, will not cause any problems.
      • Populating this with the user's PIV UPN causes AltSecID automation to ignore the account. This can be useful when the user's AltSecID needs to be unique / manually populated.

    • DHSAttribute14 not documented

    • DHSAttribute15 not documented

    • DHSAttribute16 not documented

    • DHSAttribute17 not documented

    • DHSAttribute18 not documented

    • CDHSAttribute20: not documented

  • Extension Attributes

    • extensionAttribute1:  Employe Series Sailpoint is pushing this to AD at 3AM using AD\SVC-EDME-ICAM-USRMNT.
    • extensionAttribute2: ==Unused==
    • extensionAttribute3: Employee GRADE (i.e. GS level ) and pushed to AD via Sailpoint. Assigned 8/30/19. As of 10/1/19 Sailpoint is pushing this to AD at 3AM using AD\SVC-EDME-ICAM-USRMNT.
    • extensionAttribute4:  is the Organizational code from Webtele.  Everyone in AD should have one but some contractors do not because they are not adequately documented.  The first two numbers identify the office like Border Patrol, OFO, ES/OIT, etc. Written by svc-webtele-proc. Glen Corcoran BEMSD should have the org code definitions. The top level organizations are denoted by first 2 digits:
    ORG CODE SHORT TITLE LONG TITLE
    0100000000000000 OFFICE OF THE COMMISSIONER OFFICE OF THE COMMISSIONER
    0200000000000000 OFFICE OF THE CHIEF COUNSEL OFFICE OF THE CHIEF COUNSEL
    1200000000000000 OFFICE OF CONGRESSIONAL AFFAIR OFFICE OF CONGRESSIONAL AFFAIRS
    1900000000000000 OFFICE OF PUBLIC AFFAIRS OFFICE OF PUBLIC AFFAIRS
    2400000000000000 OFFICE OF TRADE OFFICE OF TRADE
    2600000000000000 OPR-OF PROFESSNL RSPNSIBILTY OFFICE OF PROFESSIONAL RESPONSIBILITY
    3500000000000000 U.S. BORDER PATROL U.S. BORDER PATROL
    3600000000000000 OFF OF FIELD OPS OFFICE OF FIELD OPERATIONS
    3800000000000000 OFC AIR & MARINE OPS OFFICE OF AIR AND MARINE OPERATIONS
    3900000000000000 OPERATIONS SUPPORT OFFICE OPERATIONS SUPPORT OFFICE
    4200000000000000 ENTERPRISE SERVICES OFFICE ENTERPRISE SERVICES OFFICE
    4300000000000000 OFFICE OF FINANCE OFFICE OF FINANCE
    4400000000000000 OFFICE OF INTELLIGENCE OFFICE OF INTELLIGENCE

    (Last confirmed 12/15/22 with Denise Brewer)

    This section expands org code a bit into office level organizations:

    • extensionAttribute5:  Supervisor Code Webtele updates this attribute (1-8) svc-webtele-proc (on all users). Webtele consumes from SAP BEAR
    • extensionAttribute6:  ==Unused==
    • extensionAttribute7:  A NULL or any other value will Synch to Azure\O365 Automatically for User objects

    A value of "o365nosync" will filter the user's identity from synching to the Azure AD (Office 365) cloud.  This value must be cleared if you wish to again sync the AD user identity to Office 365.

    • extensionAttribute8:  Requested by CBP email engineering August 2019. Utilized by the email creation script to assign a primary email address to the proper realm for new mailboxes. Valid entries CTR, GOV, MIL, OGA, or FSN
    • extensionAttribute9:  Denotes GOVERNMENT or CONTRACTOR. Updated by Webtele (svc-webtele-proc) "SAP BEAR feed" This attribute is used by dynamic distribution groups and Other System queries.
    • extensionAttribute10 is not documented but contains first.mi.last@dhs.gov . Only a fraction of users have this attribute. Appears unused since 2018.
    • extensionAttribute11 is to mark how and AD objects O365 mailbox should be provisioned: Calendar, Resource, Shared. Will be manually set by the TSD upon AD object creation. Once marked, ESG email automation will provision accordingly. [Requested by John Petz 1/22/19]
    • extensionAttribute12 tracks user mailbox migration state. This attribute is being updated by an Orchestrator automation that is monitoring the status of the mailbox copy and required post processing actions to execute after the copy is complete. [Requested by John Petz 1/22/19]
    • extensionAttribute13 contains the user's CanonicalName. Used for Exchange Query Based Distribution lists. Account SVC-EDME-EXCHAUTO updates this attribute. Orchestrator runbook EDME\Office 365\Exchange\Update EA13 Attribute. [Requested by John Petz 1/22/19]
    • extensionAttribute14 ==Unused== (Kellerman cleaned up pre EaaS info like "NWG-EXMB-A-027 SG1_DB12" on 5/27/20)
    • extensionAttribute15 used for Employee Status based (Currently SailPoint Separation. [Requested by ICAM 6/26/19]

  • Other Attributes

    • L denotes the user's city as synchronized from Webtele
    • ipPhone: Used by Unified Communication as a Service (UCaaS) Joe Marsten POC: Updated manually by TSD?
    • mail:  this is the primary SMTP address of the user. It is synchronized by EaaS. 
    • Manager: Since June 2019 the manager attribute is written from a Sailpoint database. The manager attribute is taken from various sources depending on the user (Tele for contractors, HRBE for feds).  AD\SVC-EDME-ICAM-USRMNT has been delegated to write this attribute. The manager attribute is a distinguished name of the user's manager.
    • mobile:  user's mobile telephone number from Webtele
    • Info: AKA "Telephone Notes" is unused. It used to contain a user's Blackberry pin until December 2022 when it was cleared by Kellerman.
    • msRTCSIP-PrimaryUserAddress:  The user's SIP address used by messaging apps. This may not be used now that Skype is gone and Office 365 hosts the Teams service. It used to be synchronized from the DSA domain and is no longer.
    • postalCode:  the user's zip code from Webtele. Written by svc-webtele-proc
    • st:  State according to Webtele. Written by svc-webtele-proc
    • streetAddress: Street address from Webtele. Written by svc-webtele-proc
    • telephoneNumber according to Webtele
    • title:  The user's Title according to Webtele
    • userPrincipalName: This value is shown / modified through the ADUC 'Account' tab only. For CBP users it must be the 10-digit EDIPI@cbp.dhs.gov (Electronic Data Interchange Personal Identifier). This is the key to AltSecID automation, along with the user's email address.

OIT DAC Software
421100021* PSPD - Passenger
421100022* TASPD - Targeting
421100023* CSPD - Cargo
421100024* BEMSD - Border Enforcement

OIT DAC Infrastructure
421100030* ECSD - Cloud Services
421100031* EIOD - Infrastructure
421100032* FSD - Field Support (1 of 2)
421100033* FSD - Field Support (2 of 2)

OIT Direct reports to OIT AC
42110004* CSD - Cybersecurity
421100010* CTO - Technology

Other ES Offices
4204* OHRM - Office of Human Resources Management
4205* OTD - Office of Trade and Development
4206* OFAM - Office of Facilities and Asset Management
4208* ES Office of Acquisition

ADUC MAP
General Tab
Friendly Name Attribute Name Example
First Name givenName John
Initials initials JS
Last Name sn Smith
Display Name displayName Smith , John
Description description Sales Manager
Office physicalDeliveryOfficeName London Office
Telephone Number telephoneNumber 949-555-1234
E-mail-Addresses mail JSmith@domain.com
Common Name CN John Smith

Address Tab
Friendly Name Attribute Name Example
Street streetAddress 10 The Road
PO Box postOfficeBox Po Box 1
City l (Lowercase L) NewLondon
State/Province st New York
Zip/Postal Code postalCode 61441
Country Name c GB, DE, US etc

Group Tab
Friendly Name Attribute Name Example
Group memberOf CN=Managers,OU=Sales,DC=Domain,DC=Com

Account Tab
Friendly Name Attribute Name Example
User Logon Name userPrincipalName 9999999999@cbp.dhs.gov
User Logon Name (Pre W2K) sAMAccountName [hash]

Telephones Tab
Friendly Name Attribute Name Example
Home (Other) otherHomePhone Not Set
Pager pager 949-555-1234 (Cell Number)
Pager (Other) otherPager Not Set
Mobile mobile Not Set
Mobile (Other) otherMobile Not Set
Fax facsimileTelephoneNumber Not Set
Fax (Other) otherFacsimile Not Set
Telephone Number telephoneNumber Not Set
IP Phone ipPhone 949-555-1234
IP Phone (Other) otherIpPhone Not Set
Notes info Not Set

Organization Tab
Friendly Name Attribute Name Example
Title title Manager
Department department Sales
Company company Big Corp
Manager manager CN=SJobs,OU=Managers,DC=Domain,DC=Com
Employee ID employeeID Not Set
Employee Type employeeType Not Set
Employee Number employeeNumber Not Set
Car License carLicense Not Set
Division division Not Set
Room Number roomNumber Not Set

 
 

Group Objects

This section documents attributes specific to group objects.

ExtensionAttributes 2-4 and 11-15 are reserved for Privileged Access and EDME \ICAM Sailpoint management

  • extensionAttribute7:  Group Objects DO NOT Automatically sync to Azure AD (Office 365) cloud. 

This value must be “synco365” to synch to Azure AD (Office 365)

  • extensionAttribute2  Sailpoint: 1st APP-APPROVER Group name
  • extensionAttribute4 Sailpoint: APPOWNER_SUPER_APPROVER Group name
  • extensionAttribute10 Sailpoint: Denotes Numerical Value of available licenses for Software associated groups
  • extensionAttribute11  Sailpoint: Denotes Privileged Access if "TRUE"
  • extensionAttribute12  Sailpoint: Denotes The Server Admin Group targets and clarifies it grants Admin to ALL Servers in All the subordinate OUs when set to "TRUE"
  • extensionAttribute14 Sailpoint: Application Name/Project name

About the WebTele Process

The following information was supplied by the WebTele team, Ken Mak. Account svc-webtele-proc writes these details.
WT Field Description WT Table:Field AD Value AD Logic AD dataflow
Country - (country code): 2-digit LOC: CTRY_CD c WT updates to AD every 4 min if changed in WT WT sync pushes to AD
Agency code: always set to "CU"; we only pull CBP orgs from COMS table ORG: AGNC_CD company, DHSAttribute19 is written as "CBP" when new shell record is created... and whenever WT updates every 4 minutes if there is a change in the record,  DHSAttribute19 is set to value "1" (we only read it) if isDHS WT sync pushes to AD
Short name: used as display name in WT ORG: SHRT_NM department WT pulls from AD every 24 hrs(@ 9am) for new record, new active, WT updates to AD every 4 min if changed in WT WT sync pushes to AD;#WT sync pulls from AD
Organization code (16 digit org code) NOTE: it is not a key to the org table EMPLOYEE: ORG_ID_CD extensionAttribute4 WT pulls from AD every 24 hrs(@ 9am) for new record, new active will put in all zeros if missing. , WT pushes to AD every 4 min if changed. WT sync pushes to AD;#WT sync pulls from AD
Supervisor type code: none/not specified = 0, supervisor/manager = 2(used), supervisor = 4, management official = 5, leader = 6, team leader = 7, other = 8 EMPLOYEE: SupervisorType extensionAttribute5 WT updates to AD every 4 min if changed in WT WT sync pushes to AD
Contractor or government indicator
1= Is CBP/ Is federal employee/ Is government
0= contractor		 EMPLOYEE: USCS_EMP_ACTV extensionAttribute9 WT pulls from AD every 24 hrs(9am) if new or reactivated, WT pushes to AD every 4 min if changed. WT sync pushes to AD;#WT sync pulls from AD
FAX number  (official tab) (PHN_IND=9) PHONE: PHN_NBR facsimileTelephoneNumber WT pulls from AD every 24 hrs(@ 9am) for new record, new active WT updates to AD every 4 min if changed in WT WT sync pushes to AD;#WT sync pulls from AD
First Name EMPLOYEE: FRST_NM givenName WT pulls from AD every 24 hrs(@ 9am) for new record, new active WT sync pulls from AD
City Name LOC: CITY_NM l (lower case L) WT updates to AD every 4 min if changed in WT WT sync pushes to AD
Official Email address [*.cbp.dhs.gov] (ADDR_IND=3) EMAIL: NTRNT_ADDR:3 mail Pulls every 24 hrs, AD to WT, (we only read from AD and write to WT the official (indicator 3), will overwrite old if has changed ) WT sync pulls from AD
Mobile Number (official tab)  (PHN_IND=3) PHONE: PHN_NBR:3 mobile WT pulls from AD every 24 hrs(@ 9am) for new record, new active WT updates to AD every 4 min if changed in WT WT sync pushes to AD;#WT sync pulls from AD
Pager number code (official tab)  (PHN_IND=6) PHONE: PHN_NBR pager WT pulls from AD every 24 hrs(@ 9am) for new record, new active WT updates to AD every 4 min if changed in WT WT sync pulls from AD;#WT sync pushes to AD
Room number EMPLOYEE: RM_NBR physicalDeliveryOfficename WT updates AD every 4 min if changed concatenated with other office room number and cube WT sync pushes to AD
Room or cube number (updated by WMD/OIT or the user) EMPLOYEE: RMT_BIN_NBR physicalDeliveryOfficename WT updates AD every 4 min if changed concatenated with other office room number and cube WT sync pushes to AD
ZIP CODE LOC: PSTL_CD postalCode WT updates to AD every 4 min if changed in WT WT sync pushes to AD
Alias Email address comma separated [*.cbp.dhs.gov] (ADDR_IND=5) EMAIL: NTRNT_ADDR:5 proxyAddresses Pulls every 24 hrs, AD to WT, (we only read from AD and write to WT the official (indicator 3), will overwrite old if has changed ) WT sync pulls from AD
HashId (key) EMPLOYEE: EMP_ID_NBR sAMAccountName HashID is a unique identifier for AD, WT sync reads AD every 24 hours at 9AM, new records are created using this AD field as the HashID key WT sync pulls from AD
Last Name EMPLOYEE: LST_NM sn WT pulls from AD every 24 hrs(@ 9am) for new record, new active WT sync pulls from AD
State CODE - from location as shown on the public tab derived from TRIRIGA LOC: ST_CD st WT updates to AD every 4 min if changed in WT WT sync pushes to AD
Street Address as shown on the public tab derived from TRIRIGA list - street address 1 (primary) LOC: STR_1_ADDR streetAddress WT updates to AD every 4 min if changed in WT WT sync pushes to AD
Office number code (public tab)  (PHN_IND=2) PHONE: PHN_NBR telephoneNumber WT pulls from AD every 24 hrs(@ 9am) for new record, new active WT updates to AD every 4 min if changed in WT WT sync pushes to AD;#WT sync pulls from AD
Employee title (for government is pulled by HRBE for contractor by Supervisor or Admin) EMPLOYEE: TITL_TXT title WT pulls from AD every 24 hrs(@ 9am) for new record, new active WT updates to AD every 4 min if changed in WT WT sync pushes to AD;#WT sync pulls from AD
Employee status (1= active, 0 = inactive) EMPLOYEE: STUS_CD userAccountControl WT pulls from AD every 24 hrs(@ 9am) for new record, new active WT sync pulls from AD
Reference in New Issue View Git Blame Copy Permalink