Skip to content

Instantly share code, notes, and snippets.

@jonlabelle
Last active May 22, 2024 09:50
Show Gist options
  • Save jonlabelle/0f8ec20c2474084325a89bc5362008a7 to your computer and use it in GitHub Desktop.
Save jonlabelle/0f8ec20c2474084325a89bc5362008a7 to your computer and use it in GitHub Desktop.
LDAP Search Filter Cheatsheet
title author date source notoc
LDAP Search Filter Cheatsheet
Jon LaBelle
January 4, 2021
true

LDAP Search Filter Cheatsheet

Filter operators

Comparison operators

The following comparison operators can be used in a filter:

Operator Meaning
= Equality
>= Greater than or equal to
<= Less than or equal to
~= Approximately equal to

For example, the following filter returns all objects with cn (common name) attribute value Jon:

(cn=Jon)

Combination operators

Filters can be combined using boolean operators when there are multiple search conditions

Operator Description
& AND --- all conditions must be met
| OR --- any number of conditions can be met
! NOT --- the condition must not be met

For example, to select objects with cn equal to Jon and sn (surname/last name) equal to Brian:

(&(cn=Jon)(sn=Brian))

Special Characters

The LDAP filter specification assigns special meaning to the following characters:

Character Hex Representation
* \2A
( \28
) \29
\ \5C
Nul \00

For example, to find all objects where the common name is James Jim*) Smith, the LDAP filter would be:

(cn=James Jim\2A\29 Smith)

objectCategory and objectClass

objectCategory objectClass Result
person user user objects
person n/a user and contact objects
person contact contact objects
user user and computer objects n/a
computer n/a computer objects
user n/a user and contact objects
contact contact objects n/a
computer computer objects n/a
person user, computer, and contact objects n/a
contact n/a user and contact objects
group n/a group objects
n/a group n/a
person organizationalPerson user and contact objects
organizationalPerson user, computer, and contact objects n/a
organizationalPerson n/a user and contact objects

Use the filter that makes your intent most clear. Also, if you have a choice between using objectCategory and objectClass, it is recommended that you use objectCategory. That is because objectCategory is both single valued and indexed, while objectClass is multi-valued and not indexed (except on Windows Server 2008 and above). A query using a filter with objectCategory will be more efficient than a similar filter with objectClass. Windows Server 2008 domain controllers (and above) have a special behavior that indexes the objectClass attribute. You can take advantage of this if all of your domain controllers are Windows Server 2008, or if you specify a Windows Server 2008 domain controller in your query. --- Source

Filter basics

To match a single attribute

(sAMAccountName=<SomeAccountName>)

To match two attributes (and)

(&(objectClass=<person>)(objectClass=<user>))

To match two attributes (or)

(|(objectClass=<person>)(objectClass=<user>))

To match three attributes (and)

(&(objectClass=<user>)(objectClass=<top>)(objectClass=<person>))

To match three attributes (or)

(!(objectClass=<user>)(objectClass=<top>)(objectClass=<person>))

To perform a wildcard search

(&(objectClass=<user>)(cn=<*Marketing*>))

Sample filters

Users in group

To retrieve user account names (sAMAccountName) that are a member of a particular group (SomeGroupName):

(&(objectCategory=Person)(sAMAccountName=*)(memberOf=cn=<SomeGroupName>,ou=<users>,dc=<company>,dc=<com>))

Users in group (include nested)

To retrieve user account names (sAMAccountName), and nested user account names that are a member of a particular group (SomeGroupName):

(&(objectCategory=Person)(sAMAccountName=*)(memberOf:1.2.840.113556.1.4.1941:=cn=<SomeGroupName>,ou=users,dc=company,dc=com))

Users in multiple groups

To retrieve user account names (sAMAccountName) that are a member of any, or all the 4 groups (fire, wind, water, heart):

(&(objectCategory=Person)(sAMAccountName=*)(|(memberOf=cn=<fire>,ou=<users>,dc=<company>,dc=<com>)(memberOf=cn=<wind>,ou=<users>,dc=<company>,dc=<com>)(memberOf=cn=<water>,ou=<users>,dc=<company>,dc=<com>)(memberOf=cn=<heart>,ou=<users>,dc=<company>,dc=<com>)))

Users that must change their password at next logon

To search Active Directory for users that must change their password at next logon:

(objectCategory=person)(objectClass=user)(pwdLastSet=0)(!userAccountControl:1.2.840.113556.1.4.803:=2)

Users starting with a particular name

To search user objects that start with Common Name Brian (cn=Brian*):

(&(objectClass=user)(cn=<Brian*>))

Users by job title

To find all users with a job title starting with Manager (Title=Manager*):

(&(objectCategory=person)(objectClass=user)(Title=<Manager*>))

Active Directory filters

Search filters supported only by Microsoft Active Directory.

Domain and Enterprise Admins

To search for administrators in groups Domain Admins, Enterprise Admins:

(objectClass=user)(objectCategory=Person)(adminCount=1)

All users except blocked

To search all users except for blocked ones:

(objectCategory=person)(objectClass=user)(!userAccountControl:1.2.840.113556.1.4.803:=2)

Disabled user accounts

To list only disabled user accounts:

(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=16)

Users with password never expires enabled

(objectCategory=user)(userAccountControl:1.2.840.113556.1.4.803:=65536)

Users with empty email

(objectCategory=person)(!mail=*)

Users in department

To search users in a particular department:

(&(objectCategory=person)(objectClass=user)(department=<Sales>))

Exclude disabled users

To find as user (sAMAccountName=<username>) that isn't disabled:

(&(objectCategory=person)
(objectClass=user)
(sAMAccountType=805306368)
(!(userAccountControl:1.2.840.113556.1.4.803:=2))
(sAMAccountName=<username>))
  • The filter (sAMAccountType=805306368) on user objects is more efficient, but is harder to remember. (Source)
  • The filter (!(UserAccountControl:1.2.840.113556.1.4.803:=2)) excludes disabled user objects. (Source)

More Active Directory filters

Kore Active Directory filter samples can be found here.

References

Additional Resources

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment