I need a LDAP query for windows server 2012 AD starting from the username of a user and getting all his collegues. In my AD collegues ad identified with the same PRIMARY group.
Is it possibile or should I need a two step query?
Thank you.
Unfortunately, LDAP filtering syntax does not allow for sub-queries within the expression.
You'd have to break this into two parts - first get the user's DirectoryEntry record, then use his PrimaryGroupID in a separate filter, something like :
(&(objectClass=user)(sAMAccountName=JSmith)
Now let's say JSmith is part of the default "Domain Users" group (513) :
(&(objectCategory=person)(objectClass=user)(primaryGroupID=513))
This will return all users that share that same PrimaryGroupID.
Related
I have the AD Global Catalog configured. There are several domains in catalog. How can I query all users from one of subdomains?
I have tried such query buy nothing found
(&(objectCategory=user)(dc=sub,dc=domain,dc=com)(sAMAccountName=Administrator))
How can I fix this query to make it working?
You can use the below query to get the users from one of the subdomains in AD Global Catalog :
(&(objectCategory=person)(objectClass=user)(memberOf=cn=Domain Users,cn=Users,dc=sub,dc=domain,dc=com)(sAMAccountName=Administrator)
Reference : https://social.technet.microsoft.com/wiki/contents/articles/5392.active-directory-ldap-syntax-filters.aspx
I am querying Active Directory from SQL Server via a Linked Server called LDAP.
The linked server was created thus, authenticating through a specially created service account myDomain\ServiceAccountWithNoPermissions.
exec master.dbo.sp_addlinkedserver #server = N'LDAP', #srvproduct=N'Active Directory Service Interfaces', #provider=N'ADSDSOObject', #datasrc=N'adsdatasource'
exec master.dbo.sp_addlinkedsrvlogin #rmtsrvname=N'LDAP',#useself=N'False',#locallogin=NULL,#rmtuser=N'myDomain\ServiceAccountWithNoPermissions',#rmtpassword='########'
And I'm querying the members of a specific Active Directory Group with the following:
select *
from OpenQuery (LDAP, '
select objectGUID, sAMAccountName
from ''LDAP://myServer.myDomain.com/DC=myDomain,DC=com''
where MemberOf=''CN=Some Group,OU=Folder,DC=myDomain,DC=com''
order by sAMAccountName asc
');
Here's my problem. The above system is working correctly for some Active Directory Groups and not others.
By default I think Authenticated Users is supposed to be able to query any User or Group objects in Active Directory. And as a test I verified that the effective permissions of myDomain\ServiceAccountWithNoPermissions includes "Read all properties" on Groups for which the members are both queryable and non-queryable.
What could be the difference between Groups that are queryable and non-queryable?
You didn't describe what you mean by it working incorrectly, so I can only guess. But the most obvious thing I can see is that you're querying the membership of a group by using memberOf. Depending on how your environment is setup, that may not give you all the results you hope for. I wrote about this, but here's the important part:
Groups only get added to memberOf if they have a Group Scope of:
Universal and are in the same AD forest as the user, or
Global and are on the same domain.
Groups do not get added to memberOf if they have a Group Scope of Global and are on another domain (even if in the same forest).
On top of that, memberOf will only include Domain Local groups from the same domain of the server you are retrieving results from. (if you are working in a multi-domain environment and reading from a Global Catalog, this may not be the same domain the user is from)
It will also not report the user’s primary group (usually Domain Users), if that’s important to you, nor will it include groups on external trusted domains.
The most reliable way to find all the members of a group is to read the member attribute of the group itself. But if the group is used as the primary group for any users, then you would also have to use a different way to find those.
I have one forest like demo.com. In the forest contains two domains are first.demo.com and second.demo.com then I have several users in first.demo.com and created a group using that user. Again I created one group in second.demo.com using first.demo.com user. I want to get both groups using LDAP query.
When you run an ldap query, you query an LDAP partition, i.e. DC=first,DC=demo,DC=com. The partition DC=second,DC=demo,DC=com maybe is in the same forest, but is hosted on another domain controller and is a specific partition.
The global catalog holds information for the whole forest, but as it contains all users and groups accross the forest, some attributes are not recorded in (to minimize its size).
If you query an attribute that is not in the global catalog, my suggestion is that you should script your ldap query like this:
query the forest domain root to get the list of all domains in the forest
for each domain, run your ldap query
Found this answer here: How to find trusted domain groups using Ldap query
(Sorry for my terrible English)
I need to do a search with Ldap in AD that finds users who have at least one group, any suggestion?
Thanks a lot
Ended up as simple as it can be.
(&(objectCategory=user)(memberOf=*))
The reason is, memberOf LDAP filter does not count for "primary" group membership, which for AD DS is normally "Domain Users" and all users are normally members of that group. Therefore, if memberOf is populated, then the user is a member of any other group but primary.
i have a ldap query that only searchs for active users.
The query is the following:
"(&(objectclass=user)(objectcategory=person)(!userAccountControl:1.2.840.113556.1.4.803:=2)(whenchanged>=#LAST_DAYS#))"
I assumed that i only had to remove the "!" to get the inactive users, but i was wrong. Any ideas?
Are you sure that (whenchanged>=#LAST_DAYS#) is correct? If yes, try to query accounts without using userAccountControl and see if it returns more accounts than when you use =2. 2 stands for UF_ACCOUNT_DISABLE and corresponds to "Account is disabled" flag in the Account Properties (user may not login to the domain). You can also go to AD and see if accounts have that flag enabled.