RE: [ActiveDir] Querying for all users

[Stelley, Douglas]

I use queries like this for dozens of programs and scripts, but two of these are new to me. When I need to find/exclude a disabled account I’ll use (!userAccountControl:1.2.840.113556.1.4.803:=2). I tried briefly the (useraccountcontrol:AND:=2), or the (!(useraccountcontrol:AND:=2)) I wasn’t able to include/exclude disabled users. Is that unique to Adfind?The query I used to test for that was (&(objectcategory=person)(objectclass=user)(!useraccountcontrol:AND:=2)) brought up all users regardless of 512/514  I’d love to be able to harness the powers of adfind in some of my existing scripts and ASP pages. Is there a link with perhaps an example or two of utilizing your program within a VB/VBS/ASP? Also, using (samaccounttype=805306368), is there a listing of the possible samaccount types? Regards, Doug Stelley O monstrous world! Take note, take note, o world, To be direct and honest is not safe! -William Shakespeare.   _____   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of joe Sent: Monday, February 28, 2005 6:24 PM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] Querying for all users   A couple of different ways   adfind -bit -b dc=domain,dc=com -f "&(objectcategory=person)(objectclass=user)(!(useraccountcontrol:AND:=2))"   adfind -bit -b dc=domain,dc=com -f "&(objectcategory=person)(samaccountname=*)(!(useraccountcontrol:AND:=2))"   adfind -bit -b dc=domain,dc=com -f "&(samaccounttype=805306368)(!(useraccountcontrol:AND:=2))"   The tricky part is your requirement of being ENABLED. The only way to do that is to make sure the disabled flag is not set in the useraccountcontrol. That will seriously slow down the query.         _____   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Alex Fontana Sent: Monday, February 28, 2005 5:48 PM To: ActiveDir@mail.activedir.org Subject: [ActiveDir] Querying for all users Is there any attribute that is unique to real user accounts only (mail enabled and non-mail enabled)?  We tried teaming up objectclass=user and givenname=*, but of course not all users have to have a given name.  Then tried teaming up the objectclass with useraccountcontrol=5*, then we found out about the 66048’s and 262656’s….damn them.  So, is there an ldap query that will give me all enabled active directory user accounts?  Most likely it’s so simple I would never have even thought about it.   TIA Alex.   Confidentiality Notice: The information contained in this message may be legally privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any release, dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error please notify the author immediately by replying to this message and deleting the original message. Thank you.