Maester Packs
HighBinary packFree

AD User Attributes

Checks that Active Directory users have the attributes HR processes, Entra Connect sync and address books depend on, that those values are formatted consistently, and that they use your approved values and office locations.

Version
0.3.2
Tests
25
Connectors
1
Published
9 Nov 2026

DevClate · devclate.ad-user-attributes · 0 stars · Open source · MIT

PowerShell 
Install-MtPack DevClate/maester-pack-adua

Install only packs from sources you trust. This pack is made by DevClate, not by Maester. The site only indexes and scans it: Install-MtPack downloads it straight from github.com/DevClate/maester-pack-adua.

maester-packs.lock.json entry 
{  "Id": "devclate.ad-user-attributes",  "Source": "DevClate/maester-pack-adua",  "Version": "0.3.2",  "Commit": "33e16c74cae035b3068786259858c0d71bfb2272",  "Digest": "sha256:7f38679dcfc7e7044b9b10fe36ad7ba32a1f3e34c026f48f49db2979f22b4a1a"}

← All tests

MP.CLT.ADUA.1011 Every Active Directory employee ID belongs to only one user.

Severity: MediumCLT.ADUA.Ldap

Checks that no two Active Directory users share an employee ID (employeeID). Disabled accounts are checked too by default, because the old account of a rehired person often still holds the ID.

HR provisioning, joiner-mover-leaver scripts and Microsoft Entra Lifecycle Workflows match accounts to people by employee ID. When two accounts share one, a leaver process can disable the wrong person, or an HR update lands on the old account.

Remediation action

  1. For each ID listed below, find out which account belongs to the person in HR today.
  2. Clear or correct the ID on the other accounts: Set-ADUser -Identity <sAMAccountName> -Clear employeeID, or set the right ID with -EmployeeID.
  3. If your HR system pads IDs with zeros inconsistently (00123 and 123), run this test with IgnoreLeadingZeros set to $true to catch those as duplicates.
  4. To check only active accounts, set IncludeDisabled to $false for this test.

Related links

%TestResult%