LDAP Queries for Active Directory

LDAP Queries for Active Directory

LDAP queries are used to search Active Directory for user, group, computer, and other objects. This reference covers filter syntax, common queries, and VBScript examples.

LDAP Filter Syntax

LDAP filters use prefix notation with parentheses:

• (attribute=value). Equality match
• (attribute=*value*): substring match
• (&(filter1)(filter2)), AND
• (|(filter1)(filter2)), OR
• (!(filter)): NOT

Common LDAP Queries

# All users
(&(objectCategory=person)(objectClass=user))

# All enabled users
(&(objectCategory=person)(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

# Users in a specific OU
(&(objectCategory=person)(objectClass=user)(distinguishedName=*OU=Sales*))

# All groups
(objectCategory=group)

# All computers
(objectCategory=computer)

# Users whose password never expires
(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=65536))

# Members of a specific group
(&(objectCategory=person)(objectClass=user)(memberOf=CN=Domain Admins,CN=Users,DC=corp,DC=flamenet,DC=io))

# Users created in the last 7 days
(&(objectCategory=person)(objectClass=user)(whenCreated>=20010101000000.0Z))

# All disabled user accounts
(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=2))

# Users with no email address set
(&(objectCategory=person)(objectClass=user)(!(mail=*)))

VBScript: Search AD via ADO

Set objConnection = CreateObject("ADODB.Connection")
objConnection.Provider = "ADsDSOObject"
objConnection.Open "Active Directory Provider"

Set objCommand = CreateObject("ADODB.Command")
Set objCommand.ActiveConnection = objConnection
objCommand.CommandText = _
    "<LDAP://DC=corp,DC=flamenet,DC=io>;" & _
    "(&(objectCategory=person)(objectClass=user));" & _
    "sAMAccountName,displayName,mail;" & _
    "subtree"

Set objRecordSet = objCommand.Execute
Do Until objRecordSet.EOF
    WScript.Echo objRecordSet.Fields("displayName").Value & _
        " (" & objRecordSet.Fields("sAMAccountName").Value & ")" & _
        " - " & objRecordSet.Fields("mail").Value
    objRecordSet.MoveNext
Loop

objConnection.Close

Using LDAP from the Command Line

REM Search for all users (Windows 2000 Support Tools required)
ldifde -f users.ldf -d "DC=corp,DC=flamenet,DC=io" -r "(&(objectCategory=person)(objectClass=user))" -l "dn,sAMAccountName,mail"

REM dsquery (Windows Server 2003+ or Admin Pack)
dsquery user -name "John*" -limit 100