**AD Attribute Data Content and Management: Best Community Practice**

**v0.1**

**Status of this Memo**

This document specifies National Institutes of Health (NIH) architecture
best practice for the NIH community for Active Directory (AD) Attribute
Data Content Management and requests any suggestions for improvements.
AD user attributes were ratified by the NIH ITMC Architecture Committee
on May 25, 2004. Please refer to the current edition of NIH
"Architecture Standards Process" (NRFC 0001) for the standardization
state and status of this protocol. Distribution of this memo is intended
for the NIH community.

**Abstract**

This memo documents a set of principles for the creation and maintenance
of AD attributes. These principles include:

1.  Definition, role and responsibilities of AD Attributes;

2.  AD Account naming convention and content rule

3.  Computer naming conventions;

4.  Required documentation; and

5.  Security auditing.

This memo describes how the NIH Active Directory attribute
administration should occur and presents recommended practices for NIH
business managers, application designers/developers, and security
officers. Additionally, the goal of this BCP is to enable application
owners to decide which Attributes will best meet their specific
application requirements.

**Table of Contents**

1 Introduction [2](#introduction)

2 AD User Attribute Data Content Principles and Best Practices
[2](#ad-user-account-attribute-data-content-principles-and-best-practices)

3 Reserved AD User Attributes 9

4 AD Computer Account Data Content Principles and Best Practices 10

5 AD Object Location Management Principle 10

6 References Section 11

7 Contact 12

8 Changes 12

9 Author\'s Address 12

# Introduction

AD includes accounts for users (that is, an individual person or an
administrator), groups, computers, and resources and service accounts.
Each attribute that is either required or optional for user accounts is
described in detail in the sections that follow.

In order to facilitate a greater degree of manageability in the
creation, identification, and management of AD attributes, this BCP
shall address common best practices that will provide a framework to
enable NIH application owners to better utilize AD attributes.

This best practice shall support the NIH Enterprise Architecture
principles of "**Optimum Enterprise Benefit"** and "**Standardization of
Common Data**."

## Identified Needs

1.  Establish a common content best practices for AD user and computer
    attributes within NIH and shared with the HHS and other OPDIVS.

2.  Establish best practices and relevant guidelines required to create,
    populate and maintain AD user and computer attributes.

3.  Establish an authoritative NIH data source for information about AD
    user accounts.

4.  Establish auditing standards for AD attributes.

5.  Secure executive support and IC buy-in for the AD attribute best
    practices articulated below.

# AD User Account Attribute Data Content Principles and Best Practices

The following principles and associated best practices apply to all NIH
AD user attributes.

## AD User Account Attribute Roles and Responsibilities 

An Active Directory user account represents a legal person at NIH who
uses resources and services. Such a person might be, but is not limited
to, one of the following: NIH employees, contractors, tenants of NIH
facilities, participants in the NIH visiting programs, registered users
of NIH computer facilities, grantees, reviewers, council members, and
collaborators. Each person who uses NIH computer resources should be
issued one AD user account. Before each person is issued an AD user
account, they must first be registered in the National Institutes
Enterprise Directory (NED) and be assigned a NED ID. AD user names will
be centrally registered at CIT. This will ensure uniqueness and provide
a registry of account names to owners.

### Required AD User Attribute Data Content Management Rules

#### Last Name

Common or preferred last name of person. If no common name, then use
legal last name; does not include a generation qualifier. May contain
spaces, hyphens, and apostrophes.

AD Attribute Name: **sn** (Surname)

Max Length: 64

Example(s): "O'Connell" "della Robbia" "Smith-Davies"

#### First Name

Common or preferred first name of person. If no common name, then use
legal first name. May contain spaces, hyphens, and apostrophes.

AD Attribute Name: **givenName**

Max Length: 64

Example(s): "Chou-Chi" "Jim" "Mary Jane"

#### Employee Identifier

The NIH unique identifier assigned to a person by NED in the form of ten
digits; only one unique identifier exists per operational division
person.

AD Attribute Name: **employeeID**

Max Length: 16

Example: 0010058023

#### Employee Type

Person's employment status: Employee (all NIH Full-Time Equivalent
(FTE)), Fellow, Contractor, Guest, Volunteer, Tenant.

AD Attribute Name: **employeeType**

Max Length: 64

Examples: "Employee" "Fellow" "Contractor" "Guest" "Volunteer" "Tenant"

#### OpDiv Name

Official 2- to 6-letter (needed for SAMHSA) abbreviation for operational
division where a person works. All NIH personnel have this set to "NIH".

AD Attribute Name: **company**

Max Length: 64

Examples: "NIH" "HHS"

#### IC

Official 2- to 5-letter abbreviation of the institute or center (IC)
that the person is associated with as noted in NED.

AD Attribute Name: **department** (Department)

Max Length: 64

Examples: "CIT" "NCI" "OD"

#### Lab/Branch/Office

Official abbreviations of the Lab/Branch/Office(s) that the person is
associated with as noted in NED. 64 maximum characters, separated by
slashes as needed.

AD Attribute Name: **physicalDeliveryOfficeName**

Max Length: 64

Example(s): "CIT/DCSS/BOSB" "OD/OST/IRTP"

#### sAMAccountName

Unique name (uniname) that represents a person who uses network
resources and services.

Formula using AD attributes: **sn** + first initial of (and one or more
letters, as needed) of **givenName** + first initial (optional, if
needed) of **middleName** + digits (if needed for NIH-wide uniqueness,
not only within an IC).

20 maximum characters, truncate surname if necessary. Characters are
a-z, A-Z, and 0-9 only, no special characters allowed. Resolve NIH-wide
duplicates with a digit starting with 2. Capitalize first letter in each
name attribute used, uninames are converted into lowercase. Because of
the large number of technical dependencies, a person should only be
issued one uniname during their tenure at NIH, changeable only for legal
name changes.

AD Attribute Name: **sAMAccountName**\
Max Length: 20\
Required: Yes\
Examples: If: **sn**=Doe, **givenName**=Joseph, **middleName**=W, then:
"DoeJ" "DoeJW" "DoeJW2" "DoeJo" "DoeJos" "DoeJose" "DoeJosep"
"DoeJoseph" "DoeJosephW" "DoeJosephW2" etc.

#### userPrincipalName

Identifier for email addresses, uses AD attribute **sAMAccountName**
plus "**@**"suffix and domain address.

AD Attribute Name: **userPrincipalName**\
Max Length: 64\
Required: Yes\
Examples: "[doejw@mail.nih.gov](mailto:doejk@mail.nih.gov)"
"[doejw@nih.gov](mailto:doejk@nih.gov)"

#### mailNickname

Uses **sAMAccountName** attribute. Exchange alias, only needed for
Exchange users. Used for **proxyAddresses**.

AD Attribute Name: **mailNickname**

Max Length: 20

Example: "doejw"

#### Proxy Email Address

All supported electronic messaging addresses of a person, only needed
for Exchange users. Formula for email: "smtp:
**mailNickname**\@mail.nih.gov" is then sent to **mail** attribute.
Additional email addresses can be added (otheraddress@ic.nih.gov).

Attribute Name: **proxyAddresses** (Proxy-Addresses)

Max Length: 256

Example: "smtp:doej@mail.nih.gov FAXROUTE:1234567890 X.400:c=US,a=
,p=NIH,o=NIHEXCHANGE,s=**sn**,g=**givenName**,i=initial;"

#### Email Address

Primary SMTP email address for a person as represented by Central Email
System (CES) at NIH. Same rules as above **proxyAddresses**; pulled from
**proxyAddresses** if populated. The initial smtp address will be
generated by Exchange's Recipient Update Service (RUS) at AD user
account creation.

AD Attribute Name: **mail**

Max Length: 256

Example: "smtp:doej@mail.nih.gov"

#### Street Address

The first line is NIH Mailstop. The physical address of the person's
office (street address of building) will continue on the second line.

AD Attribute Name: **streetAddress** (Street-Address)

Max Length: 1,024

Example: "12 SOUTH DR"

#### Location (2003)

Name of building/room number.

AD Attribute Name: **roomNumber,** and **msExcangeAssistantName**

Max Length: 256

Example: "12A/2025"

#### City

The city, locality, or geographical area name.

AD Attribute Name: **l** *(lower-case "L")* (Locality-Name)

Max Length: 128

Example(s): "Bethesda" "Triangle Park" "Bletchley"

#### State

State or province postal abbreviation of location of the person's
office.

AD Attribute Name: **st** (State-Or-Province-Name)

Max Length: 128

Examples: "MD" "PR" "AE" "QC"

#### Country 

This attribute uses the ISO numeric-3 code in the background; the user
will choose from a drop-down menu that contains a list of countries by
name.

AD Attribute Name: **countryCode**

Max Length: 3

Examples: "(840) United States" "(296) Kiribati"

#### Postal Code

US Postal Service ZIP code or foreign postal code. May use a maximum of
40 and a minimum of 5 characters.

AD Attribute Name: **postalCode** (Postal-Code)

Max Length: 40

Examples: "22171" "20814-5512" "MK4 1B4"

#### Office Telephone Number

Office telephone number with area code or country and local area codes
separated by periods. Extension if any noted by space x followed by
extension number. 64 maximum characters.

AD Attribute Name: **telephoneNumber** (Telephone-Number)

Max Length: 64

Example(s): "301.496.1234" "301.555.1234 x25" "55.1.4966.1234"

#### employeeNumber

employeeNumber will have several different data entries depending on the
type of User account.

**PRIMARY**: this setting indicates the primary AD account for a live
NIH person. The NED ID will be associated with this account

**SECONDARY**: this setting indicates a live NIH person's second AD
account. An IC's Executive Officer must request and approve this
situation. NED ID is not listed for this account.

**RESOURCE**: this setting indicates a service or resource user account

**NON-NIH**: a mail-enabled non-NIH user account

#### Display Name

Displayable, "friendly" name, representative of a person.

AD Attribute Name: **displayName** (Display-Name)\
Max Length: **256\
**Required: **Yes\
**Example(s): **"Doe, James III (NIH/CIT)"**

Formula *must* use the following AD attributes: **sn**+ "**,**" +
**givenName** + **(company/department)** + **\[**first initial of
**employeeType\]**

Employee type is abbreviated and placed as a single character between
brackets **\[ \]**:

\[E\] Employee, all NIH Full Time Equivalent (FTE)

\[F\] Fellow

\[C\] Contractor

\[G\] Guest

\[V\] Volunteer

\[T\] Tenant

**Example using required attributes:** "Doe, James (NIH/CIT) \[C\]"

Formula may *optionally* use the following AD attributes:

**middleName** (or first initial of middle name) is optional, place
after **givenName**.

**generationQualifier** is optional, place after **middleName** or if
none, after **givenName**.

Titles, such as M.D. or Ph.D. are optional, place after name, before
**company.**

Further delineation of labs, branches, and offices is optional, place
after "**/**" after **company/department** within parentheses.

If display name is a duplicate, use digits, beginning with 2, place
after name (or generation qualifier or titles, if any).

**Example including optional attributes:** "Doe, James Carlos III Ph.D.
2 (NIH/CIT/DCSS/BOSB) \[C\]"

#### Canonical Name (cn)

Attribute often referenced by software applications. Matches
**displayName**.

AD Attribute Name: **cn**\
Max Length: 256\
Required: Yes\
Example: "Doe, James III (NIH/CIT) \[C\]"

### Example of Account Using Data Content Rules

This is an example of a minimum NIH AD User account entry demonstrating
only the required attributes.

**givenName** = James\
**sn** = Doe\
**employeeID** = 0010058023\
**employeeType** = Contractor\
**company** = NIH\
**department** = CIT\
**physicalDeliveryOfficeName** = CIT/DCSS/BOSB**\
sAMAccountName** = DoeJW\
**userPrincipalName** =
[doejw@mail.nih.gov](mailto:doejk@mail.nih.gov)**\
mailNickname** = doejw**\
proxyAddresses** = smtp:doej@mail.nih.gov FAXROUTE:1234567890
X.400:c=US,a= ,p=NIH,o=NIHEXCHANGE,s=**sn**,g=**givenName**,i=initial;\
**mail** = smtp:doejw@mail.nih.gov\
**street** = 12 SOUTH DR\
**msExchangeAssistantName** = 12A/2025\
**roomNumber** = 12A/2025\
**l** = Bethesda\
s**t** = MD\
**co** = US\
**countryCode** = 840\
**postalCode** = 20892-1234\
**telephoneNumber** = 301.496.1234\
**displayName** = Doe, James (NIH/CIT) \[C\]\
**cn** = Doe, James (NIH/CIT) \[C\]

AD Account names should follow the NIH Appropriate Use Policy
<http://www3.od.nih.gov/oma/manualchapters/management/2806/>, section
C.1

### Optional AD User Attributes Data Content Management Rules

#### Middle Name

Optional. Common or preferred middle name(s) of person. May contain
spaces, hyphens, and apostrophes.

AD Attribute Name: **middleName**

Max Length: 64

Example(s): (as for **givenName**, above)

#### Generation Qualifier

Optional. Generation qualifier of person, if any, without periods.

AD Attribute Name: **generationQualifier**

Max Length: 64

Examples: "Sr" "Jr" "III"

#### Fax Telephone Number

Optional. Facsimile (fax) number with area code or country and local
area codes separated by periods. Extension if any noted by space x
followed by extension number. 64 maximum characters.

AD Attribute Name: **facsimileTelephoneNumber**

Max Length: 64

Examples: "301.496.1235" "55.1.4966.1235"

#### Mobile Telephone Number

Optional. Mobile/cellular telephone number with area code or country and
local area codes separated by periods. Extension if any noted by space x
followed by extension number. 64 maximum characters.

AD Attribute Name: **mobileTelephoneNumber**

Max Length: 64

Examples: "301.496.1236" "55.1.4966.1236"

#### Pager Number

Optional. Pager telephone number with area code or country and local
area codes separated by periods. Extension if any noted by space x
followed by extension number. 64 maximum characters.

AD Attribute Name: **pagerTelephoneNumber**

Max Length: 64

Examples: "301.496.1237" "55.1.4966.1237"

## AD Resource and Service Accounts Data Content Management Rules

An entry of this type represents resources or services that are used by
persons, groups, or physical machines at NIH. A resource or service
account is not a legal person and therefore does not map to NED.

### AD Resource/Service User Accounts

Resource accounts are named using the following formula: **sn** =
**department** space "**name of resource account**" using 256 maximum
characters, a-z, A-Z, and 0-9. No special characters are allowed.

**displayName** = **sn** space **(company/department)**

For all remaining attributes, use the IC's official contact (a legal
person) and fill in their information using the rules as above.

For resource accounts, fill in the following attributes:

**sn, company, department, displayName, physicalDeliveryOfficeName,
streetAddress, msExchangeAssistant, roomNumber, l, st, co, postalCode,
telephoneNumber, ProxyAddress**

**empoyeeNumber:** add the word **RESOURCE.**

Examples of resource accounts: NHLBI Grants, NLM ConfRoom, OD Parking
Space, NIDCD backupexec, NINDS SQLservice.

### AD non-NIH User Accounts

## AD User Account Uniqueness

No two AD Accounts will be named the same. The display name will reflect
this uniqueness. Uniqueness enables the use of the user objects across
multiple directories and applications.

## AD User Account Audit Principle

All AD user account administration shall be audited. Any AD Account
additions, modifications or deletions will be tracked, recorded and
saved in a central repository. Access to audit information shall be made
available to group administrators upon request.

# Reserved AD User Account Attributes

The following AD user Account attributes are reserved due to their use
by NIH Enterprise applications (Email, Fax, Archiving) and may not be
overwritten or used by any other NIH application or technology.

## Reserved AD User Account Attributes

otherFacsimileTelephoneNumber -- used by Enterprise Fax solution

extensionAttribute7 = Blackberry PIN

extensionAttribute9 = mailboxMove data

extensionAttribute10 = free/busy

# AD Computer Account Attribute Data Content Principles and Best Practices

The following principles and associated best practices apply to all NIH
AD computer attributes.

## AD Computer Account Attribute Roles and Responsibilities Principle

An Active Directory computer account represents a computer object
(workstation, server) at NIH. Each computer object needs to be unique
and registered to a legal NIH person. The following guidelines are best
community practices for creating computer account names.

### Required AD Computer Attribute Data Content Management Rules

#### Computer Name

Computer names will have the IC prefix followed by a unique name. For
example: CIT12JoeD. 20 maximum characters. Data Content rules for
naming: use characters a-z, A-Z, and 0-9 only, no special characters
allowed; do not use character case to convey the owner or purpose of a
computer. (AD DNS is not case-sensitive.)

These additional suggestions can be used to develop a unique computer
account name:

-   Select computer names that are easy for users to remember

-   Identify the owner of a computer in the computer name

-   Select names that describe the purpose of the computer

# AD Object Location Management Principle

## AD Object Location Management Principle

In order to facilitate a greater degree of manageability in the
creation, identification, and management of AD attributes, the location
of AD objects needs to be in a consistent, programmable location.
Institute technical staff can manipulate and move the data towards their
business practices or technical design but the location of those objects
shall be under the location specified. The AD object location management
BCP shall address common best practices that will provide a framework to
enable NIH application owners to better utilize AD attributes.

### AD Object Location Rules

**\
AD User objects:** Within AD, the AD user objects are located under an
Organization Unit (OU) titled Users.

**AD Computer objects:** Within AD, the computer objects are located
under an OU titled Computers.

**AD Resource/Service User Accounts:** Within AD, the resource accounts
are located under an OU titled OPS then any OU but ending finally in
Users.

**AD Contact objects:** Within AD, the AD Contact objects are located
under an OU titled Contacts

**AD Group objects:** Within AD, the AD group objects are located under
an OU titled Groups.

**AD Distribution List objects:** Within AD, the AD distribution list
objects are located under an OU titled Distribution Lists.

**AD non-NIH User objects:** These are non-NIH accounts that are mail
enabled. All other non-NIH user objects are located within the NIH
External Directory. Non-NIH user objects are located in an OU titled
External.

# References Section

## NIH Resources

NIH Active Directory Data Standards

[outlook:\\\\Public Folders\\All Public Folders\\NIH Wide\\NIH AD\\NIH
AD
Documents](outlook:\\Public Folders\All Public Folders\NIH Wide\NIH AD\NIH AD Documents)

NIH Active Directory Infrastructure Standards

[outlook:\\\\Public Folders\\All Public Folders\\NIH Wide\\NIH AD\\NIH
AD
Documents](outlook:\\Public Folders\All Public Folders\NIH Wide\NIH AD\NIH AD Documents)

NIH RFC Formatting Standards

<https://my.nih.gov/nih/communities/community.asp?UserID=1302641&CommunityID=307&intCurrentPageIndex=0>

List of NIH IC

<http://www.nih.gov/icd/>

## Useful Websites

University of Michigan Network Directory Standards for Novell

<http://www.umich.edu/~lannos/novell/standards.html>

University of Michigan Network Directory Standards for Microsoft

<http://www.umich.edu/~lannos/windows/w2k-namingstandards.html>

Microsoft's Technical Article on Users and Groups

<http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/ad/windows2000/maintain/adusers.asp>

# Contact

To contact the BCP Editor, send an email message to
<EnterpriseArchitecture@mail.nih.gov>

# Changes

+------+------------+----------------+----------------+--------------+
| **V  | **Date**   | **Change**     | **Authority**  | **Author of  |
| ersi |            |                |                | Change**     |
| on** |            |                |                |              |
+======+============+================+================+==============+
| 0.01 | June 2006  | Original       | N/A            | Valerie      |
|      |            | document       |                | Wampler      |
+------+------------+----------------+----------------+--------------+
|      |            | -              |                |              |
+------+------------+----------------+----------------+--------------+

# Author\'s Address

Valerie Wampler

CIT

301-402-7169

<wamplerv@mail.nih.gov>