LDAP Filters for Active Directory Environments

AD - Computers:

AD - Contacts

AD - Domain Controllers

AD - Exchange Recipients

AD - Exchange Recipients - hidden

AD - Exchange Recipients - with FAX address

AD - Exchange Servers

-> Use the AD Forest configuration container as a search base!

AD - Global Catalogs
-> Use the AD Forest configuration container as a search base!

AD - Groups - empty

AD - Groups - security groups

AD - Objects - cant be deleted

AD - Objects - cant be renamed

AD - Users

AD - Users (more effective)

AD - Users - disabled

AD - Users - dont require password

AD - Users - mail enabled

AD - Users - password never expires

LDAP Filters for Novell eDirectory Environments

eDirectory - NetWare Servers

eDirectory - NetWare Volumes

eDirectory - ZEN Applications

LDAP Filters for all LDAP Environments (including Active Directory and eDirectory)

LDAP - Groups

LDAP - InetOrgperson


LDAP - Users

LDAP - Users - with Certificates
(&(|(objectClass=inetOrgPerson) (objectClass=user))(userCertificate=*))

LDAP - Users - with Passwords
-> For generic LDAP environments

LDAP - Users - without Mailaddress
-> For generic LDAP environments


Läs mer på http://www.ldapexplorer.com/en/manual/109050000-famous-filters.htm



The following table shows many example LDAP filters that can be useful when you query Active Directory:

Query LDAP Filter
All user objects (&(objectCategory=person)(objectClass=user))
All user objects (Note 1) (sAMAccountType=805306368)
All computer objects (objectCategory=computer)
All contact objects (objectClass=contact)
All group objects (objectCategory=group)
All organizational unit objects (objectCategory=organizationalUnit)
All container objects (objectCategory=container)
All builtin container objects (objectCategory=builtinDomain)
All domain objects (objectCategory=domain)
Computer objects with no description (&(objectCategory=computer)(!(description=*)))
Group objects with a description (&(objectCategory=group)(description=*))
Users with cn starting with "Joe" (&(objectCategory=person)(objectClass=user)
Object with description "East\West Sales"
(Note 2)
(description=East\5CWest Sales)
Phone numbers in form (xxx) xxx-xxx (telephoneNumber=(*)*-*)
Groups with cn starting with
"Test" or "Admin"
All users with both a first and last name. (&(objectCategory=person)(objectClass=user)
All users with direct reports but no
All users with specified email address (&(objectCategory=person)(objectClass=user)
(|(proxyAddresses=*:This email address is being protected from spambots. You need JavaScript enabled to view it.)
(mail=This email address is being protected from spambots. You need JavaScript enabled to view it.)))
Object with Common Name "Jim * Smith"
(Notes 3, 19)
(cn=Jim \2A Smith)
Objects with sAMAccountName that begins
with "x", "y", or "z"
Objects with sAMAccountName that begins
with "a" or any number or symbol except "$"
All users with "Password Never Expires" set
(Note 4)
All disabled user objects (Note 4) (&(objectCategory=person)(objectClass=user)
All enabled user objects (Note 4) (&(objectCategory=person)(objectClass=user)
All users not required to have a password
(Note 4)
All users with "Do not require kerberos
preauthentication" enabled
Users with accounts that do not expire
(Note 5)
Users with accounts that do expire (Note 5) (&(objectCategory=person)(objectClass=user)
Accounts trusted for delegation
(unconstrained delegation)
Accounts that are sensitive and not trusted
for delegation
All distribution groups (Notes 4, 15) (&(objectCategory=group)
All security groups (Notes 4, 19) (groupType:1.2.840.113556.1.4.803:=2147483648)
All built-in groups (Notes 4, 16, 19) (groupType:1.2.840.113556.1.4.803:=1)
All global groups (Notes 4, 19) (groupType:1.2.840.113556.1.4.803:=2)
All domain local groups (Notes 4, 19) (groupType:1.2.840.113556.1.4.803:=4)
All universal groups (Notes 4, 19) (groupType:1.2.840.113556.1.4.803:=8)
All global security groups (Notes 17, 19) (groupType=-2147483646)
All universal security groups (Notes 17, 19) (groupType=-2147483640)
All domain local security groups
(Notes 17, 19)
All global distribution groups (Note 19) (groupType=2)
All objects with service principal name (servicePrincipalName=*)
Users with "Allow Access" on "Dial-in"
tab of ADUC
(Note 6)
Users with "Control access though
NPS Network Policy" on "Dial-in" tab of ADUC
All groups created after March 1, 2011 (&(objectCategory=group)
All users that must change their password
at next logon
All users that changed their password since
April 15, 2011 (CST) (Note 7)
All users with "primary" group
other than "Domain Users"
All computers with "primary" group
"Domain Computers"
Object with GUID
(Note 8)
Object beginning with GUID
(Note 8)
Object with SID "S-1-5-21-73586283
-152049171-839522115-1111" (Note 9)
Object with SID "010500000000000515000
(Note 9)
All computers that are not
Domain Controllers (Note 4)
All Domain Controllers (Note 4) (&(objectCategory=computer)
All Domain Controllers (Notes 14, 19) (primaryGroupID=516)
All servers (&(objectCategory=computer)
All member servers (not DC's) (Note 4) (&(objectCategory=computer)
All direct members of specified group (memberOf=cn=Test,ou=East,dc=Domain,dc=com)
All users not direct members of
a specified group
All groups with specified direct member
(Note 19)
(member=cn=Jim Smith,ou=West,
All members of specified group, including
due to group nesting (Note 10)
All groups specified user belongs to,
including due to group nesting (Notes 10, 19)
cn=Jim Smith,ou=West,dc=Domain,dc=com)
Objects with givenName "Jim*" and sn
"Smith*", or with cn "Jim Smith*" (Note 11)
(anr=Jim Smith)
All attributes in the Schema container
replicated to the GC (Notes 6, 12)
All operational (constructed) attributes in
the Schema container (Notes 4, 12)
All attributes in the Schema container not
replicated to other Domain Controllers
(Notes 4, 12)
All objects where deletion is not allowed
(Notes 4)
Attributes whose values are copied when
the object is copied (Notes 4, 12)
Attributes preserved in tombstone object
when object deleted (Notes 4, 12)
Attributes in the Ambiguous Name
Resolution (ANR) set (Notes 4, 12)
Attributes in the Schema that are
indexed (Notes 4, 12)
Attributes marked confidential in
the schema (Notes 4, 12)
Attributes in the RODC filtered attribute
set, or FAC (Notes 4, 12)
All site links in the Configuration
container (Note 13)
The nTDSDSA objects associated with
all Global Catalogs. This will identify all DC's
that are GC's. (Note 4)
The nTDSDSA object associated with the
PDC Emulator. This will identify the DC
with the PDC Emulator FSMO role (Note 18).
The nTDSDSA object associated with the
RID Master. This will identify the DC
with the RID Master FSMO role (Note 18).
The nTDSDSA object associated with the
Infrastructure Master. This will identify the DC
with this FSMO role (Note 18).
The nTDSDSA object associated with the
Schema Master. This will identify the DC with
the Schema Master FSMO role (Note 18).
The nTDSDSA object associated with the
Domain Naming Master. This will identify the
DC with this FSMO role (Note 18).
All Exchange servers in the Configuration
container (Note 13)
All objects protected by AdminSDHolder (adminCount=1)
All trusts established with a domain (objectClass=trustedDomain)
All Group Policy objects (objectCategory=groupPolicyContainer)
All service connection point objects (objectClass=serviceConnectionPoint)
All Read-Only Domain Controllers
(Notes 4, 19)



    1. The filter (sAMAccountType=805306368) for user objects is more efficient than the more usual filter, but is harder to remember.

    2. The backslash character must be escaped in LDAP filters. Substitute \5C.

    3. The asterisk character must be escaped in LDAP filters. Substitute \2A.
    4. The string 1.2.840.113556.1.4.803 specifies LDAP_MATCHING_RULE_BIT_AND. This specifies a bitwise AND of a flag attribute (an integer), like userAccountControl, groupType, or systemFlags, and a bit mask (like 2, 32, or 65536). The clause is True if the bitwise AND of the attribute value and the bit mask is non-zero, indicating the bit is set.
    5. The accountExpires attribute is Integer8, a large 64-bit integer representing a date (in UTC) as the number of 100-nanosecond intervals since 12:00 AM January 1, 1601. If an account does not expire, then accountExpires is either 0 or 2^63-1 (9,223,372,036,854,775,807 the largest 64-bit integer allowed), both of which mean never.
    6. To filter on Boolean Active Directory attributes, like msNPAllowDialin or isMemberOfPartialAttributeSet, make sure the values TRUE or FALSE are all uppercase in the clause. This is the only time comparisons are case sensitive.
    7. The pwdLastSet attribute is Integer8.
    8. Byte arrays, like the objectGUID attribute, can be represented as a series of escaped hexadecimal bytes. The GUID {b95f3990-b59a-4a1b-9e96-86c66cb18d99} is equivalent to the hex representation "90395fb99ab51b4a9e9686c66cb18d99". Notice how the order of the first 8 bytes is reversed in groups. You specify the escaped hex bytes. You cannot specify the form in curly braces in a filter.
    9. The objectSID attribute is saved in Active Directory as a byte array. You can either specify the decimal display format S-1-5-21-73586283-152049171-839522115-1111 or the equivalent hex representation where each byte is escaped "\01\05\00\00\00\00\00\05\15\00\00\00\6B\D6\62\04\13\16\10\09\43\17\0A\32\57\04\00\00". The later might be easier in VBScript.
    10. The string 1.2.840.113556.1.4.1941 specifies LDAP_MATCHING_RULE_IN_CHAIN. This applies only to DN attributes. This is an extended match operator that walks the chain of ancestry in objects all the way to the root until it finds a match. This reveals group nesting. It is available only on domain controllers with Windows Server 2003 SP2 or Windows Server 2008 (or above).
    11. The string "anr" is an acronym for "Ambiguous Name Resolution". See the link below for complete explanation.
    12. To query for attributes in the Schema, the base of the query must be the Schema container, such as cn=Schema,cn=Configuration,dc=MyDomain,dc=com.
    13. To query for objects in the Configuration container the base of the query must be the Configuration container, such as cn=Configuration,dc=MyDomain,dc=com.
    14. The "primary" group for all Domain Controllers should be the group "Domain Controllers", which has the well-known RID 516.
    15. Many LDAP filters for various types of Active Directory groups can use the groupType attribute and skip the usual (objectCategory=group) clause. This is because only group objects can have the groupType attribute. For example, the filter (groupType=2) will retrieve all global distribution groups. However, if the filter uses the "Not" operator, such as (!(groupType:1.2.840.113556.1.4.803:=2147483648)) for all distribution groups (groups that are not security groups), you will also retrieve all objects that do not have the groupType attribute. In this case you must "And" this clause with the (objectCategory=group) clause.
    16. You might expect the LDAP filter for built-in security groups to be (groupType=2147483649) or (groupType=-2147483643). This is because the bit-wise "Or" of 2,147,483,648 (the bit mask for security groups) and 1 (the bit mask for built-in groups) would result in these values. However, this returns no results. The reason is that the built-in groups in Active Directory are also domain local. You need to account for this by Or'ing these values with 4, the bit mask for domain local groups. The result is (2,147,483,643 Or 1 Or 4) = 2,147,483,653, which after subtracting 2^32 (see Note 17) becomes -2,147,483,643. You can use either (groupType=2147483653) or (groupType=-2147483643) to retrieve all built-in domain local security groups. However, it probably makes more sense to just filter on all built-in groups with (groupType:1.2.840.113556.1.4.803:=1).
    17. The userAccountControl and groupType attributes in Active Directory are 32-bit integers. This means the values can range from -2^31 to 2^31 - 1, or -2,147,483,648 to 2,147,483,647 (the commas are shown here for readability, but are not allowed in filters). The values assigned to these attributes will be the result of a bit-wise "Or" of the appropriate bit mask for each setting. For example, the value assigned to the groupType attribute of a universal security group will be the "Or" of the bit mask for a universal group, which is 8, and the bit mask for a security group, which is 2,147,483,648. The result of (8 Or 2,147,483,648) is 2,147,483,656. Technically this value is not possible as it exceeds the maximum allowed for a 32-bit  integer. Instead, the system "wraps" the value into a negative number. The value 2,147,483,656 becomes -2,147,483,640. The rule is that if the value of a 32-bit integer is larger than 2^31 -1, subtract 2^32 (which is 4,294,967,296). The value of the groupType attribute for a universal security group becomes 2,147,967,296 - 4,294,967,296 = -2,147,483,640. This is the value your will see in Active Directory using ADSI Edit. Most utilities, scripts, and programs that accept LDAP syntax filters will work correctly with either value. However, in case the utility can only handle 32-bit integers it would be safest to use the negative number. Also, the VBScript bit-wise operators (And, Or, Xor, Not) can only handle 32-bit integers.
    18. There are five FSMO roles. For the PDC Emulator, RID Master, and Infrastructure Master roles the base of the query should be the domain. There is one of these FSMO roles for each domain. There is one Schema Master and one Domain Naming Master role for the forest. The base of the query to search for the Schema Master role should be the schema container, such as cn=Schema,cn=Configuration,dc=MyDomain,dc=com. The base of the query for the Domain Naming Master role should be the Configuration container, such as cn=Configuration,dc=MyDomain,dc=com. In all cases, the query will retrieve a nTDSDSA object. The parent of this object will have a Relative Distinguished Name identical to that of the corresponding DC. This parent object has a dnsHostName attribute whose value is the DNS name of the DC with the FSMO role.
    19. Many times you can take advantage of the fact that only one class of object in Active Directory has a particular attribute. For example, only group objects have the groupType and member attributes. This allows you to filter on groupType with a clause like (groupType=2) without using a second clause restricting the query to group objects, like (objectCategory=group). However, if your query only has the one filter, it will be checked against all objects in Active Directory. It turns out that if you also use the second clause (to restrict the query to groups), it runs faster. The results will be the same, and in most cases the time difference doesn't matter much, but a filter like (&(objectCategory=group)(member=cn=Jim Smith,ou=West,dc=MyDomain,dc=com)) is much faster than simply (member=cn=Jim Smith,ou=West,dc=MyDomain,dc=com).
    20. According to RFC 2254, the NOT operator, "!", should operate on a clause in parentheses (similar to the operators | and &). Although a clause similar to (!cn=*Smith) works in almost all cases, it would be more correct to use (!(cn=*Smith)). The first form works in VBScript, PowerShell V1, using the -LDAPFilter parameter with the PowerShell AD modules, in dsquery *, and with Joe Richards' adfind utility. However, cases have been reported where it raises an error.