CODEWITHSUNDEEP
active-directory
sorin
sorin

Reputation: 170310

Complete LDAP query to extract active Users and Service Accounts from Microsoft Active Directory

I sill fail to see the light in LDAP ;) ...

Here is the use case: I am trying to setup Jira to sync LDAP directory for login but because the directory is huge I do need to be very sensitive on how do I make the query, in order to eliminate the garbage.

I need both Users and Service Accounts.

HEre are the requirements (you are free to suggest more):

  1. Account should not start with _ # or `
  2. Should be normal account (not machine, trust or whatever)
  3. It shouldn't be a mailing list
  4. It shouldn't be a meeting room

Upvotes: 0

Views: 6004

Answers (1)

sorin
sorin

Reputation: 170310

Here is a partial solution that I have, still not completely happy. In order to make it easier to read I will put the conditions separated.

They are ordered in order to improve query speed: 

(samAccountType=805306368)                         // user/person (optimum test)
(userAccountControl:1.2.840.113556.1.4.803:=512)   // normal account
(!(userAccountControl:1.2.840.113556.1.4.803:=32)) // allow only accounts with passwords        
(mail=*)                                           // with email
(uSNChanged=*)                                     // eliminates few invalid accounts
(!(sAMAccountName=_*))
(!(sAMAccountName=#*))
(!(sAMAccountName=$*))

Compiled query:

(&(samAccountType=805306368)(!sAMAccountName=*)(userAccountControl:1.2.840.113556.1.4.803:=512)(!(userAccountControl:1.2.840.113556.1.4.803:=32))(mail=*)(uSNChanged=*)(!sAMAccountName=_*)(!sAMAccountName=#*)(!sAMAccountName=$*))

Upvotes: 5

Related Questions