AD Custom Attribute with unique value

I have custom AD attribute added to my AD schema. Attribute's syntax is Unicode String. It is added to user class and the purpose of it is to store user ID of corporate ERP system. Problem is, that I can have two or more user objects with the same value stored in that attribute, which is something that I would like to avoid. Is there a way to configure AD attribute so it is unique within the domain boundary? (The same behavior as sAMAccountName attribute.)

i.e :

If there already exists user object in AD with this attribute set to "JSmith" and I try to set that attribute with the same value for another user, Direcory Services will refuse to update that object and give me "already exists" error.

Domain functional level is windows 2003.


AD doesn't built-in functionality to allow schema extensions to have enforced uniqueness. Being a loose convergence multi-master database makes this a Hard Problem(tm). There is functionality built-in to check for duplication of some built-in schema attributes, but there are even situations when this can fail.

Your best hope is going to be to write something that periodically "groveled" though AD and alerted an Administrator to duplication (or to initiate some kind of conflict resolution logic on your own).