EASYENTRA

Knowledge Base

Advanced AD Searching

Use case: Use this procedure to perform advanced and flexible real-time Active Directory searches. This is useful when you need to locate specific objects or attributes efficiently in large or complex directory structures.

The EasyEntra AD search field supports standard and advanced LDAP queries, as well as a “relaxed typing” mode that lets you use simple, human-readable expressions instead of complex LDAP syntax.
For details, see How to Use Relaxed Typing for AD Searches (below the video).

To perform an advanced AD search, do the following:

  • Select the OU from where you want to base your search (subtree search is default).
  • Type in your search phrase or query.
  • Use of wildcards is supported.
  • Single or multiple search results can be opened and modified.
How to do advanced AD queries with EasyEntra.

Automatic Query Conversion

EasyEntra automatically converts simple search phrases into valid LDAP queries. For example:

  • disabled=true → (userAccountControl:1.2.840.113556.1.4.803:=2)
  • enabled=true → (!(userAccountControl:1.2.840.113556.1.4.803:=2))
  • lockedout=true → (&(objectCategory=Person)(objectClass=User)(lockoutTime>=1))
  • sam=jlennon → samaccountname=jlennon
  • upn=jelo@beatles.com → userprincipalname=jelo@beatles.com
  • state=idaho → (st=idaho)
  • city=boise → (l=boise)
  • zip=83702 → (postalCode=83702)
  • alias=j.doe → (mailNickname=j.doe)
  • mail=niels.bohr@panum.dk → (proxyaddresses=smtp:niels.bohr@panum.dk)
  • email=niels.bohr@panum.dk → (proxyaddresses=smtp:niels.bohr@panum.dk)
  • type=user → (&(objectCategory=person)(objectClass=user))
  • type=group → (objectCategory=group)
  • type=contact → (&(objectCategory=person)(objectClass=contact))
  • type=computer → (objectCategory=computer)
  • BitLocker=7a4f → (&(objectClass=msFVE-RecoveryInformation)(name=7aef*))
  • bl=7a4f → (&(objectClass=msFVE-RecoveryInformation)(name=7aef*))
  • badpwdtime>2024-08-01 → (badpasswordtime>=133670232000000000)
  • passwordlastset<2024-08-01 → (pwdlastset<=133668504000000000)
  • whencreated<2024-01-01 → (whencreated<=20231231000000.0Z)

As shown, EasyEntra handles inconsistent attribute naming, obscure OIDs, and varying date/time formats in LDAP queries automatically — so you can focus on results instead of syntax.

To see examples of these queries in use, refer to:

ID:KB_078_AdvancedADSearching