LDAP query in PowerShell

Question

I'm trying to run the below query in PowerShell with no success :(

((mailNickname=id*)(whenChanged>=20170701000000.0Z))(|(userAccountControl=514)(userAccountControl=66050))(|(memberof=CN=VPN,OU=VpnAccess,OU=Domain Global,OU=Groups,OU=01,DC=em,DC=pl,DC=ad,DC=mnl)(memberof=CN=VPN-2,OU=VpnAccess,OU=Domain Global,OU=Groups,OU=01,DC=em,DC=pl,DC=ad,DC=mnl))

what is this query? and what you are trying to achieve ? Which part is a Powershell cmdlet here? I can see only pipeline which is in PS and some dsqury object — Ranadip Dutta
– Ranadip Dutta, Commented Aug 10, 2017 at 8:16
Keep in mind that userAccountControl is a bitmap, not a simple numeric value. — Bill_Stewart
– Bill_Stewart, Commented Aug 10, 2017 at 13:01

Ben · Accepted Answer · 2018-05-09 07:18:16Z

22

Without Get-ADUser cmdlet (ActiveDirectory RSAT module):

$Filter = "((mailNickname=id*)(whenChanged>=20170701000000.0Z))(|(userAccountControl=514)(userAccountControl=66050))(|(memberof=CN=VPN,OU=VpnAccess,OU=Domain Global,OU=Groups,OU=01,DC=em,DC=pl,DC=ad,DC=mnl)(memberof=CN=VPN-2,OU=VpnAccess,OU=Domain Global,OU=Groups,OU=01,DC=em,DC=pl,DC=ad,DC=mnl))"
$RootOU = "OU=01,DC=em,DC=pl,DC=ad,DC=mnl"

$Searcher = New-Object DirectoryServices.DirectorySearcher
$Searcher.SearchRoot = New-Object System.DirectoryServices.DirectoryEntry("LDAP://$($RootOU)")
$Searcher.Filter = $Filter
$Searcher.SearchScope = $Scope # Either: "Base", "OneLevel" or "Subtree"
$Searcher.FindAll()

edited May 9, 2018 at 7:18

Ben

606 bronze badges

answered Aug 10, 2017 at 8:34

iRon

24.4k10 gold badges60 silver badges107 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Ben Over a year ago

I had to add a host name to the first argument of the DirectoryEntry constructor, and also a username and password as 2nd and 3rd arguments, for this to work. But this was the right, approach, thanks!

Mathias R. Jessen · Accepted Answer · 2017-08-10 08:23:48Z

12

Given the contents of the query filter, I'd say you're looking for a user, so I'd suggest using the Get-ADUser cmdlet from the ActiveDirectory RSAT module:

Get-ADUser -LDAPFilter '((mailNickname=id*)(whenChanged>=20170701000000.0Z))(|(userAccountControl=514)(userAccountControl=66050))(|(memberof=CN=VPN,OU=VpnAccess,OU=Domain Global,OU=Groups,OU=01,DC=em,DC=pl,DC=ad,DC=mnl)(memberof=CN=VPN-2,OU=VpnAccess,OU=Domain Global,OU=Groups,OU=01,DC=em,DC=pl,DC=ad,DC=mnl))'

answered Aug 10, 2017 at 8:23

Mathias R. Jessen

178k13 gold badges175 silver badges234 bronze badges

Collectives™ on Stack Overflow

LDAP query in PowerShell

2 Answers 2

1 Comment

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related