Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How would I build an LDAP query for AD that returns all users in a particular security group whose accounts are not disabled?

I tried

(&(objectClass=person)(!(userAccountControl=ACCOUNTDISABLE)))

but that doesn’t seem to work.

I’m attempting to setup Google Apps Directory Sync and would like it to sync all users that are part of the “Google Apps Users” security group whose accounts are not disabled (or optionally, just suspend accounts in GA if they are disabled in AD).

share|improve this question
add comment

4 Answers 4

Looks like this will work, but it won't pick up nested group members:

(&
    (memberOf=CN=GApsUsers,DN=....)
    (!(userAccountControl=546))
)
share|improve this answer
    
ok, "(&(memberOf=CN=Google Apps Users,DC=bbc,DC=pri)(!(userAccountControl=546)))" works, but it still returns users who have been disabled I have two people in that group, one of them is disabled, but GADS is retrieving 2 user accounts from that LDAP query. –  Corey Aug 9 '10 at 19:00
    
Ok, did some googleing, and found something that works for the account control “(!(userAccountControl:1.2.840.113556.1.4.803:=2))” –  Corey Aug 9 '10 at 20:04
    
This is what I ended up going with. (&(memberOf=CN=Google Apps Users,DC=bbc,DC=pri)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) –  Corey Aug 26 '10 at 13:32
    
Thanks for the help! –  Corey Aug 26 '10 at 13:34
    
You should do a bitwise AND on bit 2 for 'account disabled', rather than checking the userAccountControl value in total; other bits might be set. –  crb Sep 6 '11 at 18:19
show 2 more comments
up vote 4 down vote accepted

This works!

(&(memberOf=CN=Google Apps Users,DC=bbc,DC=pri)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
share|improve this answer
    
I had to delete the extra set of parenthesis to get this to work, as Tony Roth suggested below. –  msemack May 22 '12 at 18:45
add comment

Sometimes a set of yes/no values is stored in a single value by setting various bits. You can use a bitmask to check if they are set.

For example, 546 in decimal is the binary value 10 0010 0010 - in decimal, the sum of 512, 32, and 2. (All those numbers are powers of 2, which means they only have one '1' in their binary representation): That means those three yes/no values are set.

According to the userAccountControl docs that means the following values are set:

NORMAL_ACCOUNT (512)
PASSWD_NOTREQD (32)
ACCOUNTDISABLE (2)

However, for example, if you had a user who did not have PASSWD_NOTREQD set (so their userAccountControl value was 512), or one who also had DONT_EXPIRE_PASSWORD (65536) set (meaning their value was 66082), you would not find those users in your query.

What you need to do is use a bitwise AND in order to query the value of only that bit:

10 0010 0010
00 0000 0010
------------
00 0000 0010

If the value for that bit is 1, then that bit is set. It doesn't matter what the other bits are set to, so you are effectively asking if userAccountControl & 2 == 2.

The LDAP syntax for checking a bit using AND is 1.2.840.113556.1.4.803, therefore you can see if the ACCOUNTDISABLE bit is set with (userAccountControl:1.2.840.113556.1.4.803:=2). Adding (!(foo)) around it gives you all the users who are not disabled.

share|improve this answer
    
"(userAccountControl:1.2.840.113556.1.4.803:=2)" is what i ended up using, you can see that in the accepted answer –  Corey Sep 13 '11 at 1:30
    
I am aware of that, but I wanted to point out to any future people who might find this page, why sysadmin1138's answer was incomplete. –  crb Sep 15 '11 at 17:22
    
Kudos for the explanation. –  DReispt Aug 2 '12 at 21:01
add comment

close but

(&(objectClass=person)(!(userAccountControl=ACCOUNTDISABLE)))

should be

(&(objectClass=person)(!userAccountControl=ACCOUNTDISABLE))

please note that I can't really test this from where I'm at!

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.