CODEWITHSUNDEEP
active-directoryldap
daisy
daisy

Reputation: 23571

Pure ldap query to search useraccountcontrol with DONT_EXPIRE_PASSWORD flag set

I'm trying to use ldapsearch command to search for accounts with DONT_EXPIRE_PASSWD flag set:

enter image description here

Since LDAP query syntax does not support binary AND op, what should I use on userAccountControl property?

I can't use Get-AdUser PowerShell commandlet, I need an LDAP query.

Upvotes: 2

Views: 964

Answers (1)

daisy
daisy

Reputation: 23571

LDAP does support a binary AND operation, e. g.:

(&(objectCategory=Person)(UserAccountControl:1.2.840.113556.1.4.803:=65536))

Where 1.2.840.113556.1.4.803, also known as the LDAP_MATCHING_RULE_BIT_AND, is the binary AND operation.

Upvotes: 1

Related Questions