The carLicense attribute is a built-in user attribute in Active Directory (AD). It inherits from the inetOrgPerson schema (RFC 2798) and was originally defined to store a vehicle license or registration plate. In practice, it's often repurposed to hold any short license or ID-style value, such as driver's license numbers, parking permits, security badge IDs, and fleet assignments.
This article covers what carLicense is, where it lives in the schema, and how to manage it using three approaches: Active Directory Users and Computers (ADUC), PowerShell, and ADManager Plus.
| Attribute | Value |
|---|---|
| LDAP display name | carLicense |
| CN | carLicense |
| Syntax | Win32 ADSchema renders this as String (Unicode) and MS-ADLS as attributeSyntax: 2.5.5.12 |
| OM-Syntax | 64 |
| Attribute ID (OID) | 2.16.840.1.113730.3.1.1 |
| System ID GUID | d4159c92-957d-4a87-8a67-8d2934e01649 |
| Single- or multi-valued | Multi-valued |
| Indexed | No |
| In Global Catalog | No |
| Replicated | Yes, within the domain |
| Visible in default ADUC UI | No, requires Attribute Editor |
| Applies to | Windows Server 2003 and later; |
| Source schema | inetOrgPerson (RFC 2798) |
| Microsoft reference | Win32 ADSchema ยท MS-ADLS |
Note: Although the attribute name suggests a single license, carLicense is multi-valued. A single user object can hold more than one value, and the attribute is useful when one person is associated with multiple vehicles, permits, or licenses.
carLicense was introduced as part of the inetOrgPerson schema (RFC 2798) to store a vehicle license or registration plate. Since AD inherits that schema, every AD user object includes the attribute out of the box.
In real-world deployments, organizations rarely use it for vehicle plates alone. Common repurposed uses include:
carLicense is a standard string attribute that ships with every AD schema, with no schema extension required. It's also multi-valued, which fits users who hold more than one entry.
If you need stricter naming or stricter access control, a custom schema extension is the cleaner path. carLicense is best used when the data is non-sensitive, you can tolerate the default-readable ACL, and you want zero schema changes.
PowerShell is the right tool when you need to handle more than a few users at once, or when you want repeatable change records you can attach to a ticket or change request.
To add the carLicense attribute, use the Set-ADUser cmdlet along with the -Add parameter.
Set-ADUser -Identity john -Add @{carLicense="ZY-6543"}
The -Add parameter preserves any existing values and appends the new one. Use this when carLicense already has data you want to keep.
To replace the existing attribute value, use this command:
Set-ADUser -Identity john -Replace @{carLicense="ZY-6543"}
To replace with multiple values at once:
Set-ADUser -Identity john -Replace @{carLicense=@("ZY-6543","RT-5678")}
This command deletes only the specified value from the attribute. Any other carLicense values on the user object are preserved.
Set-ADUser -Identity john -Remove @{carLicense="ZY-6543"}
This queries all users in the domain, filters to those with a carLicense value set, joins multiple values with semicolons for readability, and exports the result to a CSV file.
Get-ADUser -Filter * -Properties carLicense |
Where-Object { $_.carLicense } |
Select-Object Name, sAMAccountName, @{N='carLicense';E={$_.carLicense -join '; '}} |
Export-Csv .\carLicense-report.csv -NoTypeInformation
ADUC doesn't expose carLicense in the standard user properties tabs. To view or edit the value, you'll have to work through the Attribute Editor tab.
This unlocks the Attribute Editor tab on user objects.
ADManager Plus allows you to add carLicense as a field and manage it using templates, bulk imports, and delegated workflows without enabling Advanced Features or opening the Attribute Editor.
Use this for joiner workflows, parking permit refresh cycles, or fleet reassignment.
If carLicense is part of your standard joiner provisioning, you can add it to a user creation template:
ADManager Plus includes prebuilt user attribute reports, and you can build a custom one for carLicense:
To delegate just carLicense updates to a parking administrator or security officer without giving them broader user-write access:
The delegated user signs in to ADManager Plus, sees only the carLicense field on the user object, and every change is logged in the audit trail.
carLicense is multi-valued. A single user object can hold more than one carLicense entry.
No, carLicense is replicated within the domain. You can mark it for Global Catalog replication via the Schema MMC if your forest needs cross-domain visibility.
No, the LDAP name is fixed. You can change its display name in ADManager Plus, but the underlying LDAP attribute stays carLicense.
No, not by default. carLicense isn't in the standard Entra Connect attribute set, but you can add it as a custom directory extension if you need cloud visibility.
The attribute isn't indexed by default. For high-volume search use cases, indexing it via the Schema MMC will improve query performance, but at the cost of larger directory database size and slightly slower writes since the index must be maintained on each DC.