Active Directory: Attribute Character Limits

When synchronizing data from a source system like HR, you may encounter errors if the source data exceeds the maximum character length of the target attribute in Active Directory. If the source value is too long, Active Directory will reject the update, causing a synchronization error.

The solution is to use the SUBSTRING function within the synchronization template. This function allows you to truncate the source value to ensure it fits within the allowed character limit of the AD attribute.

Common Attribute Lengths

Below is a reference list of the default maximum character lengths for common Active Directory attributes.

Attribute	Max Length
`cn`	64
`company`	64
`initials`	6
`name`	255
`physicalDeliveryOfficeName`	128
`postOfficeBox`	40
`st` (State/Province)	128
`streetAddress`	1024
`title`	64

Find Attribute Length with PowerShell

You can find the maximum length for any attribute in your AD schema by using the following PowerShell script.

To use the script, save it as a .ps1 file and run it from a PowerShell terminal with the attribute's lDAPDisplayName as a parameter. For example: .\Get-ADAttributeLength.ps1 -attributeName "telephoneNumber"

PowerShell

[cite_start]param ([string] $attributeName = $(throw "Specify attribute name")) [cite: 55]
[cite_start]$rootDSE = [ADSI]"LDAP://RootDSE" [cite: 56]
[cite_start]$attribute = [ADSI]"LDAP://CN=$attributeName,$($rootDSE.schemaNamingContext)" [cite: 57]
[cite_start]if ($attribute.rangeUpper -eq $null) { [cite: 58]
    [cite_start]"no limit" [cite: 60]
[cite_start]} else { [cite: 61]
    [cite_start]$attribute.rangeUpper [cite: 64]
}