CODEWITHSUNDEEP
active-directoryldap
Miguel Morujão
Miguel Morujão

Reputation: 1161

LDAP only inactive users query

i have a ldap query that only searchs for active users. The query is the following:

"(&(objectclass=user)(objectcategory=person)(!userAccountControl:1.2.840.113556.1.4.803:=2)(whenchanged>=#LAST_DAYS#))"

I assumed that i only had to remove the "!" to get the inactive users, but i was wrong. Any ideas?

Upvotes: 2

Views: 2956

Answers (1)

user2316116
user2316116

Reputation: 6814

Are you sure that (whenchanged>=#LAST_DAYS#) is correct? If yes, try to query accounts without using userAccountControl and see if it returns more accounts than when you use =2. 2 stands for UF_ACCOUNT_DISABLE and corresponds to "Account is disabled" flag in the Account Properties (user may not login to the domain). You can also go to AD and see if accounts have that flag enabled.

enter image description here

Upvotes: 2

Related Questions