Ldap filter enabled users

(&(objectCategory=organizationalPerson)(objectClass=User)(userAccountControl:1.2.840.113556.1.4.803:=2))


for disabled users:

(&(objectCategory=organizationalPerson)(objectClass=User)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

LDAP syntax filters

=	Equality
>=	Greater than or equal to (lexicographical)
<=	Less than or equal to (lexicographical)
&	AND, all conditions must be met
|	OR, any of the conditions must be met
!	NOT, the clause must evaluate to False

all user object filter:  (&(objectCategory=person)(objectClass=user)) 

a more efficient all user object filter: (sAMAccountType=805306368)

source

Verify active directory user and password

Add-Type -AssemblyName System.DirectoryServices.AccountManagement

$context = [System.DirectoryServices.AccountManagement.ContextType]::Domain

$principalc = New-Object System.DirectoryServices.AccountManagement.PrincipalContext($context, 'local.intra', 'testuser','pass')

$principalc.ConnectedServer

$principalc.ValidateCredentials('testuser','pass')

Query active directory with dsquery

dsquery can be used to retrieve any active directory attribute or filter for any active directory attribute using LDAP filter;

Ex: find user with employeeid=1234

dsquery * -filter (employeeid=1234) -attr attribute_name

to retrieve all active directory attribute user star (-attr *);

LDAP syntax

LDAPFilter parameter of the Get-ADuser cmdlet is much easy to use an type;

One LDAPFilter conditions is enclosed in parenthesis and an operator will precede two conditions:

Eg. ( & (condition one) (condition two) ) - translate as condition one AND condition two

( | (condition one) (condition two) ) - translate as condition one OR condition two

 Logical conditions are formed using Active Directory attributes names like objectClass, objectCategory, name.

Eg.: to search for all users whose name start with "z" we will use:
(&(objectcategory=person)(name=z*))


 Get-ADUser -LDAPFilter {(&(objectCategory=person)(name=z*))}

It is recomended to use objectCategory instead of objectClass when ever possible because objectClass attribute can have multiple values and objectCategory is an indexed attribute in Active Directory and will speed up the search.