Use LDAP filtering to quickly get the information you need from Active Directory or Office 365.
You can use LDAP filtering from PowerShell or even directly in AD Users & Computers. LDAP filters are a super-powerful tool to build reports or do bulk editing.
LDAP filters are processed server-side on the domain controller. You should always filter objects server-side to improve performance.
LDAP filters in their simplest form only match an AD attribute name with a value:
[attribute name]=[attribute value]
Attribute names are the “raw” names you find in the “Attribute Editor” tab in AD Users & Computers.
Attribute names and values are case-insensitive.
For more complex queries, the following four operators should cover most of your needs:
| Operator | Meaning | Sample Expression |
|---|---|---|
| & | And | (&(department=sales)(c=us)) |
| | | Or | (|(department=sales)(department=marketing)) |
| ! | Not | (!description=external) |
| * | Wildcard | (sAMAccountName=EXT*) |
As seen in the above examples & (and) and | (or) will perform an and/or on all statements nested in the following parentheses.
E.g. to find all objects where department equals ‘sales’ AND city equals ‘Berlin’ AND country equals ‘Germany’ you would use the following filter:
(&(department=sales)(l=berlin)(c=DE))When you start combining multiple AND and OR operators it quickly leads to higher complexity. Consider the following sample LDAP filter which identifies all users OR groups that have ‘temp’ OR ‘tmp’ in their description attribute:
(&(|(&(objectClass=user)(objectCategory=person))(objectClass=group))(|(description=*temp*)(description=*tmp*)))In order to construct (or decode) a complex LDAP query you should break it up on several lines like so:
(&
(|
(&
(objectClass=user)
(objectCategory=person)
)
(objectClass=group)
)
(|
(description=*temp*)
(description=*tmp*)
)
)Let’s have a look at the structure:
Line 3 – 6:
Since objectClass=user also returns computer objects, we need to AND with objectCategory=person to only retrieve user objects.
Line 2 – 8:
We limit our search to include only user OR group objects.
Line 9 – 12:
We limit our search to objects that have ‘temp’ OR ‘tmp’ in their description attribute.
Line 1 – 13:
We wrap up our query by AND’ing (users OR groups) with (‘temp’ OR ‘tmp’ in description)
It may take a few tries to get your head around it, but once you have created your first handful of LDAP queries you’ll soon become fluent 😉
PowerShell and LDAP Filter
A lot of the PowerShell get commands, like Get-ADUser, have an LDAPFilter switch (to learn more about the Filter switch read this article).
The LDAPFilter switch takes an LDAP filter query string and allows you to easily list AD objects that match certain criteria.
The following example lists all AD users that are in the marketing department:
Get-ADUser -LDAPFilter '(department=marketing)'The PowerShell command, Get-ADUser, automatically limits your LDAP search to user objects.
Get-ADGroup and Get-ADComputer have a similar limiting effect on your AD search.
EasyEntra and LDAP Filter
You can use EasyEntra to run LDAP queries.
To execute an LDAP filter, start EasyEntra, select the OU from where you want to base your search (subtree search is default), and type in your search phrase or LDAP query.
Single or multiple search results can be opened and modified.
Furthermore, EasyEntra LDAP queries support friendly names, e.g. “state=idaho” instead of “st=idaho”,
“city=boise” instead of “l=boise”, and “disabled=true” instead of “userAccountControl:1.2.840.113556.1.4.803:=2”.
Watch a recording with examples of LDAP queries performed in EasyEntra:
For more videos on EasyEntra features, visit our how-to section by clicking here.
Summary
Mastering the basics of LDAP filtering can save you a lot of time and allow you to retrieve information efficiently.
To work even more efficiently, have a look at EasyEntra.
EasyEntra is a stand-alone application that simplifies user administration in hybrid Microsoft 365 and cloud-only environments. It empowers your first-level helpdesk to do senior-level management of Entra ID users, mailboxes, and licenses.
EasyEntra provides one unified, intuitive, and efficient interface, so you no longer have to switch between multiple tools to perform daily management:
Imagine that you no longer have to log in to the Microsoft 365 Admin Center, the Exchange Online Admin Center, or the Azure Portal for daily user management.
You can even synchronize Azure AD Connect directly from EasyEntra.
You can also remove your on-premises Exchange server to avoid future zero-day exploits.
Start your zero-risk 30-day trial now. With just a few minutes to install, we guarantee you’ll be saving hours of work before the end of the week with EasyEntra.
