Maester Packs
HighBinary packFree

AD User Attributes

Checks that Active Directory users have the attributes HR processes, Entra Connect sync and address books depend on, that those values are formatted consistently, and that they use your approved values and office locations.

Version
0.3.2
Tests
25
Connectors
1
Published
9 Nov 2026

DevClate · devclate.ad-user-attributes · 0 stars · Open source · MIT

PowerShell 
Install-MtPack DevClate/maester-pack-adua

Install only packs from sources you trust. This pack is made by DevClate, not by Maester. The site only indexes and scans it: Install-MtPack downloads it straight from github.com/DevClate/maester-pack-adua.

maester-packs.lock.json entry 
{  "Id": "devclate.ad-user-attributes",  "Source": "DevClate/maester-pack-adua",  "Version": "0.3.2",  "Commit": "33e16c74cae035b3068786259858c0d71bfb2272",  "Digest": "sha256:7f38679dcfc7e7044b9b10fe36ad7ba32a1f3e34c026f48f49db2979f22b4a1a"}

← All tests

MP.CLT.ADUA.1014 Active Directory country values use an approved spelling.

Severity: LowCLT.ADUA.Ldap

Checks that enabled Active Directory users use one approved spelling for each country. It checks co (the country name that Active Directory Users and Computers shows) by default; set Attribute to c to check the two-letter code instead.

co is free text when it is set with PowerShell or an HR import, so United States, USA and US all appear. Microsoft Entra Connect syncs co as country, where dynamic groups and reports then treat them as three countries.

Without approved countries (this test's AllowedCountries, or co in CLT.ADUA.AllowedValues), one spelling passes and several report Investigate with the spellings in use.

Remediation action

  1. Decide on one spelling per country, and list them in maester-config.json: { "GlobalSettings": { "CLT.ADUA.AllowedValues": { "co": ["United States", "Canada"] } } }.
  2. Fix each user listed below in Active Directory Users and Computers (Address tab > Country/region), which sets c, co and countryCode together, or with PowerShell: Set-ADUser -Identity <sAMAccountName> -Replace @{ c = 'US'; co = 'United States'; countryCode = 840 }.
  3. If an HR import writes the country, fix the mapping there so it writes the approved spelling.

Related links

%TestResult%