Common Active Directory attributes

A quick reference for the attributes that come up most often when working with Active Directory from application code.

Identity

Attribute	Type	Notes
`sAMAccountName`	String	Legacy short logon name, unique per domain
`userPrincipalName`	String	Email-shaped logon name
`distinguishedName`	String	Full DN of the entry
`objectGUID`	Binary	Permanent unique identifier — use this as a stable foreign key
`objectSid`	Binary	Security identifier, used in access tokens
`cn`	String	Common name / display name, part of the RDN

Personal info

Attribute	Type	Notes
`givenName`	String	First name
`sn`	String	Surname
`mail`	String	Primary email address
`telephoneNumber`	String	Phone number
`title`	String	Job title
`department`	String	Department name

Group membership

Attribute	Type	Notes
`memberOf`	Multi-valued DN	Groups this object belongs to (computed, includes nested membership)
`member`	Multi-valued DN	On a group entry: its direct members

Account status

Attribute	Type	Notes
`userAccountControl`	Integer bitmask	Encodes enabled/disabled, password-never-expires, and more
`pwdLastSet`	Large integer	Windows FILETIME (100-ns intervals since 1601); `0` means "must change at next logon"
`accountExpires`	Large integer	Windows FILETIME, or `0`/max value for "never expires"
`lockoutTime`	Large integer	Non-zero when the account is currently locked out

Note

userAccountControl is a bitmask, not a single flag — the most commonly checked bit is 0x2 (ACCOUNTDISABLE). Rather than parsing this by hand, many applications instead rely on the bind operation itself failing with a decodable status; see Authentication in Active Directory.

Timestamps

Active Directory timestamps come in two different formats, which is a frequent source of bugs:

Windows FILETIME (pwdLastSet, accountExpires, lastLogonTimestamp): 100-nanosecond intervals since January 1, 1601 UTC, as a large integer.
Generalized Time (whenCreated, whenChanged): a human-readable string like 20240115120000.0Z.

Always check which format a given attribute uses before treating it as a date — assuming one when the attribute actually uses the other silently produces wildly wrong dates.

What's next

Continue to Authentication to see how account status attributes like these surface as bind errors in practice.