A question came to me last week when I was doing a deep drill of Azure AD Connect user attribute mapping and replication:

What attributes can an Active Directory user object possibly have? Not just the populated ones. Not just the ones visible in AD Users & Computers advanced view. But: ALL OF THEM!

I looked around and found a couple of half answers.聽One post suggested looking at the mayContain and systemMayContain attributes of the User object in the AD Schema.聽Also, in forums you’ll see partial answers to this intriguing question.

To get THE FULL answer you need to understand the way Active Directory schema classes inherit their attributes.

In the Active Directory schema you will find all definitions of classes and attributes.

A class can be of three types:

A class (of any type) may have up to four lists of attributes included in it’s definition. These lists are defined in the following class attributes:

Additionally, all classes inherit from a parent class (except the root of all classes, the “top” class).

The following diagram shows you how the user class is designed in the Active Directory schema: