LDAP Filters for Active Directory Environments

AD - Computers:
(objectCategory=Computer)

AD - Contacts
(objectCategory=contact)

AD - Domain Controllers
(&(objectCategory=Computer)
(userAccountControl:1.2.840.113556.1.4.803:=8192))

AD - Exchange Recipients
(mailNickname=*)

AD - Exchange Recipients - hidden
(&(msExchHideFromAddressLists=TRUE)(!objectClass=publicFolder))

AD - Exchange Recipients - with FAX address
(proxyAddresses=FAX:*)

AD - Exchange Servers
(&(objectClass=msExchExchangeServer)(!(objectClass=msExchExchangeServerPolicy)))

-> Use the AD Forest configuration container as a search base!

AD - Global Catalogs
(&(objectCategory=nTDSDSA)(options:1.2.840.113556.1.4.803:=1))
-> Use the AD Forest configuration container as a search base!

AD - Groups - empty
(&(objectClass=group)(!member=*))

AD - Groups - security groups
(groupType:1.2.840.113556.1.4.803:=2147483648)

AD - Objects - cant be deleted
(systemFlags:1.2.840.113556.1.4.803:=-2147483648)

AD - Objects - cant be renamed
(systemFlags:1.2.840.113556.1.4.803:=134217728)

AD - Users
(&(objectCategory=person)(objectClass=user))

AD - Users (more effective)
(sAMAccountType=805306368)

AD - Users - disabled
(&(sAMAccountType=805306368)(userAccountControl:1.2.840.113556.1.4.803:=2))

AD - Users - dont require password
(&(sAMAccountType=805306368)(userAccountControl:1.2.840.113556.1.4.803:=32))

AD - Users - mail enabled
(&(sAMAccountType=805306368)(mailNickname=*))

AD - Users - password never expires
(&(sAMAccountType=805306368)(userAccountControl:1.2.840.113556.1.4.803:=65536))

LDAP Filters for Novell eDirectory Environments

eDirectory - NetWare Servers
(objectClass=ncpServer)

eDirectory - NetWare Volumes
(objectClass=volume)

eDirectory - ZEN Applications
(objectClass=appApplication)

LDAP Filters for all LDAP Environments (including Active Directory and eDirectory)

LDAP - Groups
(|(objectClass=group)(objectClass=groupOfNames))

LDAP - InetOrgperson
(objectClass=inetOrgPerson)

LDAP - OUs
(objectClass=organizationalUnit)

LDAP - Users
(|(objectClass=inetOrgPerson)(objectClass=user))

LDAP - Users - with Certificates
(&(|(objectClass=inetOrgPerson) (objectClass=user))(userCertificate=*))

LDAP - Users - with Passwords
(&(objectClass=inetOrgPerson)(userPassword=*))
-> For generic LDAP environments

LDAP - Users - without Mailaddress
(&(objectClass=inetOrgPerson)(!(mail=*)))
-> For generic LDAP environments

Läs mer på http://www.ldapexplorer.com/en/manual/109050000-famous-filters.htm

Examples

The following table shows many example LDAP filters that can be useful when you query Active Directory:

NOTES

    1. The filter (sAMAccountType=805306368) for user objects is more efficient than the more usual filter, but is harder to remember.
   

    2. The backslash character must be escaped in LDAP filters. Substitute \5C.

    3. The asterisk character must be escaped in LDAP filters. Substitute \2A.
    4. The string 1.2.840.113556.1.4.803 specifies LDAP_MATCHING_RULE_BIT_AND. This specifies a bitwise AND of a flag attribute (an integer), like userAccountControl, groupType, or systemFlags, and a bit mask (like 2, 32, or 65536). The clause is True if the bitwise AND of the attribute value and the bit mask is non-zero, indicating the bit is set.
    5. The accountExpires attribute is Integer8, a large 64-bit integer representing a date (in UTC) as the number of 100-nanosecond intervals since 12:00 AM January 1, 1601. If an account does not expire, then accountExpires is either 0 or 2^63-1 (9,223,372,036,854,775,807 the largest 64-bit integer allowed), both of which mean never.
    6. To filter on Boolean Active Directory attributes, like msNPAllowDialin or isMemberOfPartialAttributeSet, make sure the values TRUE or FALSE are all uppercase in the clause. This is the only time comparisons are case sensitive.
    7. The pwdLastSet attribute is Integer8.
    8. Byte arrays, like the objectGUID attribute, can be represented as a series of escaped hexadecimal bytes. The GUID {b95f3990-b59a-4a1b-9e96-86c66cb18d99} is equivalent to the hex representation "90395fb99ab51b4a9e9686c66cb18d99". Notice how the order of the first 8 bytes is reversed in groups. You specify the escaped hex bytes. You cannot specify the form in curly braces in a filter.
    9. The objectSID attribute is saved in Active Directory as a byte array. You can either specify the decimal display format S-1-5-21-73586283-152049171-839522115-1111 or the equivalent hex representation where each byte is escaped "\01\05\00\00\00\00\00\05\15\00\00\00\6B\D6\62\04\13\16\10\09\43\17\0A\32\57\04\00\00". The later might be easier in VBScript.
    10. The string 1.2.840.113556.1.4.1941 specifies LDAP_MATCHING_RULE_IN_CHAIN. This applies only to DN attributes. This is an extended match operator that walks the chain of ancestry in objects all the way to the root until it finds a match. This reveals group nesting. It is available only on domain controllers with Windows Server 2003 SP2 or Windows Server 2008 (or above).
    11. The string "anr" is an acronym for "Ambiguous Name Resolution". See the link below for complete explanation.
    12. To query for attributes in the Schema, the base of the query must be the Schema container, such as cn=Schema,cn=Configuration,dc=MyDomain,dc=com.
    13. To query for objects in the Configuration container the base of the query must be the Configuration container, such as cn=Configuration,dc=MyDomain,dc=com.
    14. The "primary" group for all Domain Controllers should be the group "Domain Controllers", which has the well-known RID 516.
    15. Many LDAP filters for various types of Active Directory groups can use the groupType attribute and skip the usual (objectCategory=group) clause. This is because only group objects can have the groupType attribute. For example, the filter (groupType=2) will retrieve all global distribution groups. However, if the filter uses the "Not" operator, such as (!(groupType:1.2.840.113556.1.4.803:=2147483648)) for all distribution groups (groups that are not security groups), you will also retrieve all objects that do not have the groupType attribute. In this case you must "And" this clause with the (objectCategory=group) clause.
    16. You might expect the LDAP filter for built-in security groups to be (groupType=2147483649) or (groupType=-2147483643). This is because the bit-wise "Or" of 2,147,483,648 (the bit mask for security groups) and 1 (the bit mask for built-in groups) would result in these values. However, this returns no results. The reason is that the built-in groups in Active Directory are also domain local. You need to account for this by Or'ing these values with 4, the bit mask for domain local groups. The result is (2,147,483,643 Or 1 Or 4) = 2,147,483,653, which after subtracting 2^32 (see Note 17) becomes -2,147,483,643. You can use either (groupType=2147483653) or (groupType=-2147483643) to retrieve all built-in domain local security groups. However, it probably makes more sense to just filter on all built-in groups with (groupType:1.2.840.113556.1.4.803:=1).
    17. The userAccountControl and groupType attributes in Active Directory are 32-bit integers. This means the values can range from -2^31 to 2^31 - 1, or -2,147,483,648 to 2,147,483,647 (the commas are shown here for readability, but are not allowed in filters). The values assigned to these attributes will be the result of a bit-wise "Or" of the appropriate bit mask for each setting. For example, the value assigned to the groupType attribute of a universal security group will be the "Or" of the bit mask for a universal group, which is 8, and the bit mask for a security group, which is 2,147,483,648. The result of (8 Or 2,147,483,648) is 2,147,483,656. Technically this value is not possible as it exceeds the maximum allowed for a 32-bit  integer. Instead, the system "wraps" the value into a negative number. The value 2,147,483,656 becomes -2,147,483,640. The rule is that if the value of a 32-bit integer is larger than 2^31 -1, subtract 2^32 (which is 4,294,967,296). The value of the groupType attribute for a universal security group becomes 2,147,967,296 - 4,294,967,296 = -2,147,483,640. This is the value your will see in Active Directory using ADSI Edit. Most utilities, scripts, and programs that accept LDAP syntax filters will work correctly with either value. However, in case the utility can only handle 32-bit integers it would be safest to use the negative number. Also, the VBScript bit-wise operators (And, Or, Xor, Not) can only handle 32-bit integers.
    18. There are five FSMO roles. For the PDC Emulator, RID Master, and Infrastructure Master roles the base of the query should be the domain. There is one of these FSMO roles for each domain. There is one Schema Master and one Domain Naming Master role for the forest. The base of the query to search for the Schema Master role should be the schema container, such as cn=Schema,cn=Configuration,dc=MyDomain,dc=com. The base of the query for the Domain Naming Master role should be the Configuration container, such as cn=Configuration,dc=MyDomain,dc=com. In all cases, the query will retrieve a nTDSDSA object. The parent of this object will have a Relative Distinguished Name identical to that of the corresponding DC. This parent object has a dnsHostName attribute whose value is the DNS name of the DC with the FSMO role.
    19. Many times you can take advantage of the fact that only one class of object in Active Directory has a particular attribute. For example, only group objects have the groupType and member attributes. This allows you to filter on groupType with a clause like (groupType=2) without using a second clause restricting the query to group objects, like (objectCategory=group). However, if your query only has the one filter, it will be checked against all objects in Active Directory. It turns out that if you also use the second clause (to restrict the query to groups), it runs faster. The results will be the same, and in most cases the time difference doesn't matter much, but a filter like (&(objectCategory=group)(member=cn=Jim Smith,ou=West,dc=MyDomain,dc=com)) is much faster than simply (member=cn=Jim Smith,ou=West,dc=MyDomain,dc=com).
    20. According to RFC 2254, the NOT operator, "!", should operate on a clause in parentheses (similar to the operators | and &). Although a clause similar to (!cn=*Smith) works in almost all cases, it would be more correct to use (!(cn=*Smith)). The first form works in VBScript, PowerShell V1, using the -LDAPFilter parameter with the PowerShell AD modules, in dsquery *, and with Joe Richards' adfind utility. However, cases have been reported where it raises an error.