Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

While working on an application which queries AD for user information, I kept retrieving Domain Controllers as part of my results.

Using C# DirectorySearcher with the following filter:


After some digging around, I noticed that for our DCs, the objectClass attribute is set to:

top; person; organizationalPerson; user; computer

It struck me kind of odd. However, I have no frame of reference and was not able to locate any specific documentation about it.

Can someone please advise if this looks right, if not, what should it be. Also, any documentation/best practices/standards regarding this will be appreciated.

share|improve this question

closed as off topic by MDMarra, Ward, Lucas Kauffman, Michael Hampton, Scott Pack Oct 1 '12 at 14:01

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 2 down vote accepted

Technically, you have to filter on 2 values. First, objectCategory=Computer because domain controllers are a computer like any other, and second, you need to filter flags on the userAccountControl attribute looking for servers with the ADS_UF_SERVER_TRUST_ACCOUNT flag.

ADS_UF_SERVER_TRUST_ACCOUNT is 0x1000 or 8192 in decimal. Doing a binary and on active-directory attributes is done using the 1.2.840.113556.1.4.803 operator. So, your query would ultimately look like this:

share|improve this answer
Tested and yes that only shows me DCs. Saved for future. However, my question was a bit broader. I was wondering if the "objectClass" is setup properly. – Nasir Sep 27 '12 at 14:19
objectClass finds User accounts. As strange as it sounds... even computers/domain-controllers have User accounts. If you're looking for actual users, you should use organizationalPerson or something else... Machine accounts are used to communicate with each other in almost exactly the same manner as user accounts communicating with a user. When a workstation joins the domain, a computer "user" account is created (usually named something similar to $computername ) and a unique password is created, and all secure transactions between servers is done using that account. – TheCompWiz Sep 27 '12 at 14:26
Thanks for the clarification. – Nasir Sep 27 '12 at 15:40

Another query for domain controller objects that may perform better is (&(objectCategory=computer)(primaryGroupId=516)). 521 for Read-Only domain controllers. Or for both: (&(objectCategory=computer)(|(primaryGroupId=516)(primaryGroupId=521)))

Probably not very noticeable in small domains, however in domains with large number of computer objects, the userAccountControl: queries may take a very long time.

If you are performing a query for the server object that appears in Active Directory Sites and Services, that would be: (objectCategory=server) and the base would need to be the configuration naming context.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.