LDAP Search Filter Cheatsheet

ldap_search_filter_cheatsheet.md

title	LDAP Search Filter Cheatsheet
author	Jon LaBelle
date	January 4, 2021
source	https://jonlabelle.com/snippets/view/markdown/ldap-search-filter-cheatsheet
notoc	true

LDAP Search Filter Cheatsheet

A comprehensive reference for constructing LDAP search filters, with practical examples for common queries.

• Filter operators
  • Comparison operators
  • Combination operators
  • Special Characters
• objectCategory and objectClass
• Filter basics
  • To match a single attribute
  • To match two attributes (and)
  • To match two attributes (or)
  • To match three attributes (and)
  • To match three attributes (or)
  • To perform a wildcard search
• Sample filters
  • Users in group
  • Users in group (include nested)
  • Users in multiple groups
  • Users that must change their password at next logon
  • Users starting with a particular name
  • Users by job title
• Active Directory filters
  • Domain and Enterprise Admins
  • All users except blocked
  • Disabled user accounts
  • Users with password never expires enabled
  • Users with empty email
  • Users in department
  • Exclude disabled users
• Additional useful filters
  • Computer accounts
  • Service accounts
  • Groups with specific attributes
  • Objects modified within timeframe
  • Users by location
  • Empty organizational units
• References
• Additional Resources

Filter operators

Comparison operators

The following comparison operators can be used in a filter:

Operator	Meaning
=	Equality
>=	Greater than or equal to
<=	Less than or equal to
~=	Approximately equal to

For example, the following filter returns all objects with cn (common name) attribute value Jon:

(cn=Jon)

Combination operators

Filters can be combined using boolean operators when there are multiple search conditions:

Operator	Description
&	AND — all conditions must be met
|	OR — any number of conditions can be met
!	NOT — the condition must not be met

For example, to select objects with cn equal to Jon and sn (surname/last name) equal to Brian:

(&(cn=Jon)(sn=Brian))

Special Characters

The LDAP filter specification assigns special meaning to the following characters:

Character	Hex Representation
*	\2A
(	\28
)	\29
\	\5C
Nul	\00

For example, to find all objects where the common name is James Jim*) Smith, the LDAP filter would be:

(cn=James Jim\2A\29 Smith)

objectCategory and objectClass

objectCategory	objectClass	Result
person	user	user objects
person	n/a	user and contact objects
person	contact	contact objects
user	n/a	user and computer objects
computer	n/a	computer objects
contact	n/a	contact objects
group	n/a	group objects
n/a	group	group objects
person	organizationalPerson	user and contact objects
organizationalPerson	n/a	user and contact objects

Use objectCategory instead of objectClass in your filters.

objectCategory is faster because it's single-valued and indexed. objectClass is multi-valued and typically not indexed, making queries slower.

Filter basics

To match a single attribute

(sAMAccountName=SomeAccountName)

To match two attributes (and)

(&(objectClass=person)(objectClass=user))

To match two attributes (or)

(|(objectClass=person)(objectClass=user))

To match three attributes (and)

(&(objectClass=user)(objectClass=top)(objectClass=person))

To match three attributes (or)

(|(objectClass=user)(objectClass=top)(objectClass=person))

To perform a wildcard search

(&(objectClass=user)(cn=*Marketing*))

Sample filters

Users in group

To retrieve user account names (sAMAccountName) that are a member of a particular group (SomeGroupName):

(&(objectCategory=Person)(sAMAccountName=*)(memberOf=cn=SomeGroupName,ou=users,dc=company,dc=com))

Users in group (include nested)

To retrieve user account names (sAMAccountName), and nested user account names that are a member of a particular group (SomeGroupName):

(&(objectCategory=Person)(sAMAccountName=*)(memberOf:1.2.840.113556.1.4.1941:=cn=SomeGroupName,ou=users,dc=company,dc=com))

Users in multiple groups

To retrieve user account names (sAMAccountName) that are a member of any of the 4 groups (fire, wind, water, heart):

(&(objectCategory=Person)(sAMAccountName=*)(|(memberOf=cn=fire,ou=users,dc=company,dc=com)(memberOf=cn=wind,ou=users,dc=company,dc=com)(memberOf=cn=water,ou=users,dc=company,dc=com)(memberOf=cn=heart,ou=users,dc=company,dc=com)))

Users that must change their password at next logon

To search Active Directory for users that must change their password at next logon:

(&(objectCategory=person)(objectClass=user)(pwdLastSet=0)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

Users starting with a particular name

To search user objects that start with Common Name Brian (cn=Brian*):

(&(objectClass=user)(cn=Brian*))

Users by job title

To find all users with a job title starting with Manager (Title=Manager*):

(&(objectCategory=person)(objectClass=user)(Title=Manager*))

Active Directory filters

Search filters supported only by Microsoft Active Directory.

Domain and Enterprise Admins

To search for administrators in groups Domain Admins, Enterprise Admins:

(&(objectClass=user)(objectCategory=Person)(adminCount=1))

All users except blocked

To search all users except for blocked ones:

(&(objectCategory=person)(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

Disabled user accounts

To list only disabled user accounts:

(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=2))

Users with password never expires enabled

(&(objectCategory=user)(userAccountControl:1.2.840.113556.1.4.803:=65536))

Users with empty email

(&(objectCategory=person)(!(mail=*)))

Users in department

To search users in a particular department:

(&(objectCategory=person)(objectClass=user)(department=Sales))

Exclude disabled users

To find a user (sAMAccountName=username) that isn't disabled:

(&(objectCategory=person)(objectClass=user)(sAMAccountType=805306368)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(sAMAccountName=username))

• The filter (sAMAccountType=805306368) on user objects is more efficient, but is harder to remember.
• The filter (!(userAccountControl:1.2.840.113556.1.4.803:=2)) excludes disabled user objects.

Additional useful filters

Computer accounts

To find all computer accounts in Active Directory:

(objectCategory=computer)

To find computer accounts that are not disabled:

(&(objectCategory=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

Service accounts

To find service accounts (accounts with Service Principal Names):

(&(objectCategory=person)(objectClass=user)(servicePrincipalName=*))

To find accounts used as service accounts that don't require Kerberos pre-authentication:

(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304))

Groups with specific attributes

To find all security groups:

(&(objectCategory=group)(groupType:1.2.840.113556.1.4.803:=2147483648))

To find all distribution groups:

(&(objectCategory=group)(!(groupType:1.2.840.113556.1.4.803:=2147483648)))

To find empty groups (no members):

(&(objectCategory=group)(!(member=*)))

Objects modified within timeframe

To find objects modified after a specific date (uses generalized time format):

(whenChanged>=20240101000000.0Z)

To find objects created within the last 30 days (approximate):

(whenCreated>=20240715000000.0Z)

Users by location

To find users in a specific city:

(&(objectCategory=person)(objectClass=user)(l=New York))

To find users in a specific state/province:

(&(objectCategory=person)(objectClass=user)(st=California))

To find users in a specific country:

(&(objectCategory=person)(objectClass=user)(co=United States))

Empty organizational units

To find organizational units with no child objects:

(&(objectCategory=organizationalUnit)(!(ou=*)))

References

• Atlassian Support: How to write LDAP search filters
• TheITBros.com: Active Directory LDAP Query Examples
• Active Directory: LDAP Syntax Filters

Additional Resources

• Active Directory Glossary - This is a glossary of terms and acronyms used in Active Directory and related technologies.
• Microsoft Docs: Active Directory Schema (AD Schema) Definitions - Formal definitions of every attribute that can exist in an Active Directory object.

Hi. Need to be corrected: https://gist.github.com/jonlabelle/0f8ec20c2474084325a89bc5362008a7#to-match-three-attributes-or
Perhaps you should write "|" instead of "!"

Hi. Need to be corrected: https://gist.github.com/jonlabelle/0f8ec20c2474084325a89bc5362008a7#to-match-three-attributes-or Perhaps you should write "|" instead of "!"

Good catch! Thanks @Juris-ru.