I am trying to retrieve an exhaustive list of users’ attributes, along with their ability/inability to be edited by allowed users (I do not care here about permissions, but only about system restrictions).

I have checked the official Microsoft AD documentation, but the process is pretty tedious (there is a LOT of attributes). However, the data seems trustworthy: Out of the few I checked, the property “System-Only” indicated clearly if the property was writable by users.

I then headed to my AD console (MMC -> schema) to try to get this data directly from my AD instance, but the data displayed there is really slim.

Finally, I programatically exported the entire schema and the complete list of attributes under the user class, along with all of their parameters:

name | isSingleValued | rangeLower | rangeUpper | oMSyntax | attributeSyntax | mayContain | systemMayContain | systemMustContain

The three last ones are booleans that (to my understanding) respectively indicate if the attribute may be edited by an allowed AD user, may be edited by the AD system, and will always be filled automatically by the AD system.

However, I noticed that this wasn’t quite true: for example, the sAMAccountName params go like this: mayContain: false | systemMayContain: false | systemMustContain: true

Which implies the attribute cannot be edited manually, but exclusively automatically by the system (which is practically not true)

Is there any way I retrieve the informations available on the AD documentation (especially System-Only) directly from the AD system (such as the schema) ?