---
title: Changing the Activate AD User Attribute
slug: changing-the-activate-ad-user-attribute
createdAt: 2025-06-11T20:26:21.328Z
---

## Background

By default, Activate records whether a user has registered answers to their Password Security questions in the AD attribute extensionAttribute1 on the user object.
The data stored looks like:
*\<?xml version="1.0" encoding="utf-16"?>\<user>\<password>\<answers set="1" when="2013-08-29T10:52:57" />\</password>\</user>*

Sometimes, addressing client requirements dictates that other data is also stored in the extensionAttribute1 attribute. While not common, it underscores the importance of reserving the attribute for Activate’s exclusive use

This article explains how to change the default attribute that Activate will use in Active Directory.

Notes:

- The AD attribute Activate uses cannot be used by other systems to store data. If other systems write to the same attribute, the data that Activate stores can be overwritten.
- Ideally no user objects in AD should have any data stored in this attribute when Activate is installed.
  This can be checked using PowerShell:

  ```text
   get-aduser -Filter 'extensionAttribute1 -like "*"'
  ```

   This should not list any users. If users are using the selected attribute, this data should be cleared out if it is not being used by other systems.

## How to change the AD Attribute Activate uses

If other systems are writing to extensionAttribute1:

1. Find an unused attribute from extensionAttributes1 – extensionAttribute15

   ```text
   get-aduser -Filter extensionAttributex -like "*"'
   ```
2. Change //Resources/User/ExtensionAttribute (see screenshot below) to use the attribute found above.
3. Restart the Activate Orchestrator Service and the Activate app pool.

//Resources/User/ExtensionAttribute

By