Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am a developer with minimal knowledge of Active Directory, and am working on a system that needs to sync users with AD. I am initially given a list of users' email addresses from a client (e.g., and need to match the given addresses with those that I pull from AD, which may have a different suffix (e.g.

In order to do this, I would like to determine all different suffixes that are valid for a user's email address at the company.. but I am at a loss of how to do this. I am assuming that these suffixes are either the domain the user belongs to, or any UPN set by the company? Or can the suffixes be arbitrary? Can a user belong to different domains or are they limited to one?

Basically, I would really love to know how to query AD in order to find out what are possible valid aliases for Any ideas or info that helps me achieve that would be much appreciated...


share|improve this question
Are you assuming the organization is using Exchange? If you aren't talking specifically about Exchange, then I suspect you are out of luck. There is nothing in my AD that would tell you about my Google Apps Domain. – Zoredache Jan 31 '13 at 23:25
UPNs and email addresses are two distinct things. Getting a list of UPNs isn't the same as email addresses and vice versa. You'll need to explain your setup better. – TheCleaner Feb 1 '13 at 3:25

If you're able to talk to AD with LDAP utilities, it should be pretty easy given a list of emails. I use a similar command to build a list of every email address we're willing to accept delivery for so it can be pushed out to our Postfix mail gateways. If you worked for the Patriots, and only knew Tom Brady's email address of '', this would get you all of his other addresses (the one with SMTP in caps is the default reply address in Exchange). The ldapsearch command is line-wrapped:


ldapsearch -h -x -D -w 'AGoodPassword' \

-b 'dc=corp,dc=patriots,dc=com' '' proxyAddresses


# Tom Brady, UserAccounts, Accounts,

dn: CN=Tom Brady,OU=Players,OU=Accounts,DC=corp,DC=patriots,DC=com








Most of that command is just the configuration of the ldap connection, allowing it to connect to any domain controller by specifying only the domain name as the host. The -x is to do simple authentication instead of SASL, then I give the UPN and password of an account specifically created as a Domain Guest only and solely for the purpose of running a few different little scripts like this. The -b option is telling it where to start the search, so you can narrow it just to a specific OU or something, though here I just search the entire directory.

After all that, you get to the bits you're actually interested in, first a search filter of '' since you know that email for him, and then the attribute(s) that you want back. Here I only want proxyAddresses, but you could instead ask for telphoneNumber, streetAddress, state, or whatever you have populated in AD (or you can get back everything AD knows about a user by leaving the attribute off altogether... then you can use the output from that full search and pick any of those other attributes to use as your search filter).

Aplogies for the length, didn't mean to ramble but I have no idea how much of that is familiar to you or not.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.