Find Active Directory Attributes in AD Users and Computers

Updated 5 November 2026 · Standard formula, shown below

Finding an Active Directory (AD) attribute lets you inspect the values stored on a user, computer, group, or other directory object—for example, a username, email address, department, or account setting. You can view attributes with Active Directory Users and Computers (ADUC) or PowerShell; you’ll need an account and computer with permission to read the directory.

What You’ll Need

A Windows computer connected to your organization’s network or domain, or otherwise able to reach its domain controller.
Active Directory Users and Computers, included with Remote Server Administration Tools (RSAT) on supported Windows editions, or PowerShell with the Active Directory module.
The object’s name, logon name, email address, or distinguished name (DN) to help find it.
Read access to the object. Ordinary domain accounts often have read access, but access can be restricted by your administrator.

Step-by-Step

Choose the method. Use ADUC to browse and inspect an object visually. Use PowerShell when you need an exact attribute name, want to query by a known identifier, or need to view several attributes at once. Both methods show directory data; neither grants permission to change it.
Open Active Directory Users and Computers. Search the Start menu for “Active Directory Users and Computers” and launch it. If it is not installed, ask your IT administrator about installing RSAT and the AD DS tools. On a managed computer, you may need administrator approval to add Windows features.
Connect to the correct domain if needed. In ADUC, right-click the console’s root node and choose Change Domain to select a domain. To query a different domain controller, use Change Domain Controller. If you are unsure which domain to use, check with your administrator rather than guessing.
Find the object. Expand the domain and browse to the relevant organizational unit (OU), or use the Find command from the domain’s context menu. Search by a distinctive name or account identifier. Check the object type and location: a user, computer, and group with similar names are different objects.
Open the object’s properties. Double-click the object, or right-click it and select Properties. The tabs show commonly used settings, but they do not display every attribute stored in AD.
Show the Attribute Editor tab. If the tab is absent, close the properties window. In ADUC, select View and enable Advanced Features, then reopen the object’s properties. Select Attribute Editor to see attribute names and their values. This changes the console view, not the directory object.
Locate and inspect the attribute. Scroll through the list or use its sorting to find the exact attribute name. Select it and choose Edit or View, as available, to inspect the value. Be cautious: the editor can also permit changes. Do not save edits unless you are authorized and intend to change directory data.
Query with PowerShell when useful. Open PowerShell with the Active Directory module available, then run a read-only query such as Get-ADUser -Identity jsmith -Properties mail,department,telephoneNumber. Replace jsmith with the correct identity and specify the attributes you need. To see all properties returned for a user, use Get-ADUser -Identity jsmith -Properties *; this can produce a large amount of output.
Read the PowerShell result carefully. An attribute requested with -Properties appears in the returned object, even if its value is blank. Use Select-Object to show only the fields you need, for example Get-ADUser -Identity jsmith -Properties mail,department | Select-Object Name,SamAccountName,mail,department. For other object types, use the corresponding cmdlet, such as Get-ADComputer or Get-ADGroup.
Record the exact attribute name and value. AD display labels and schema attribute names can differ. For scripts or support requests, copy the schema name exactly, note which object you checked, and distinguish an empty value from an attribute that was not requested or displayed.

Common Mistakes

Looking only at standard property tabs: many attributes appear only in Attribute Editor or a PowerShell query.
Forgetting Advanced Features: the Attribute Editor tab is hidden until this view option is enabled.
Using a display label as an attribute name: for example, a friendly label may not match the LDAP display name used in scripts. Verify the exact schema name before querying.
Searching the wrong domain or OU: objects can have similar names or exist in multiple domains. Confirm the object’s identity and location.
Assuming blank means missing: a blank value can mean the attribute is unset. Some values are also calculated, stored differently, or not returned unless explicitly requested.
Editing while trying to inspect: Attribute Editor may allow changes. Avoid applying or saving changes unless you have approval and understand the impact.

Tips

Prefer a unique identifier such as a logon name or DN when names are duplicated.
In PowerShell, request only the extra attributes you need with -Properties; default output does not include every directory attribute.
Use Get-ADObject when you know an object’s DN or need to inspect an object type not covered by a more specific cmdlet. For example: Get-ADObject -Identity "CN=Example,OU=People,DC=example,DC=com" -Properties description. Substitute the real DN and attribute.
Do not share screenshots or command output containing personal or organizational information outside approved channels.
When comparing results, check whether you queried the same domain controller. Replication can cause recently changed values to differ temporarily between controllers.

Troubleshooting

ADUC or the Attribute Editor is missing: Confirm that RSAT’s Active Directory tools are installed, then reopen the console. In ADUC, enable View > Advanced Features and reopen the object properties. If the option or tool is unavailable, ask your administrator about your Windows edition and access.

PowerShell says the command is not recognized: The Active Directory module may not be installed or imported. On a supported system with RSAT, try Import-Module ActiveDirectory. If that fails, request the AD PowerShell tools from IT; do not download modules from untrusted sources.

The object cannot be found: Check spelling and whether you used the right identity type. Try the object’s full DN, confirm the selected domain, or ask an administrator whether the object was moved, renamed, or deleted.

Access is denied or results are incomplete: Your account may lack read permission for that object or attribute, or the query may target a domain controller you cannot reach. Contact your directory administrator with the object and exact attribute name. Do not attempt to bypass permissions.

The attribute appears blank or the value seems outdated: Confirm the exact attribute name and request it explicitly in PowerShell. Check another authorized domain controller if appropriate, and allow for replication. Ask the directory administrator to verify the stored value and replication status.

Frequently Asked Questions

What is an Active Directory attribute?
An attribute is a field associated with a directory object, such as a user’s email address, a computer’s operating system, or a group’s description.

How do I see all attributes in ADUC?
Enable View > Advanced Features, open the object’s properties, and select Attribute Editor. Some data may still be unavailable because of permissions or how it is stored.

How do I find an attribute by name in PowerShell?
Use the relevant AD cmdlet and include the attribute in -Properties, such as Get-ADUser -Identity jsmith -Properties mail. Replace the identity and attribute with the ones you need.

Why can’t I see Attribute Editor?
Advanced Features may be disabled, or you may not be viewing an object’s properties in ADUC. Enable the feature and reopen the properties window.

Can I view attributes without changing them?
Yes. Opening properties or running a read-only PowerShell query does not itself change directory data. Avoid saving edits in Attribute Editor.

Does a blank attribute mean the object is missing?
No. The object may exist while that particular attribute has no value. Verify the object identity and query the exact attribute before drawing a conclusion.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.