RSS

windows 域的LDAP查询相关举例

17 Mar

需求是枚举单个ou下所有用户的相关信息。

 

使用(objectCategory=user)能查询当前域内所有的(包括禁用的)user以及contact的信息。

下面是一些我觉得可能对你有用的查询代码:

如果要寻找新创建的用户,可以使用(objectCategory=person)(whenCreated>=20081001000000.0Z)来查询2008年10月01日后创建的帐户。

(objectCategory=person)(objectclass=user)(whenCreated>=20081001000000.0Z)可以排除contact

如果你要查询不在某个组内的用户,你可以使用

(objectCategory=user)(!memberof=CN=LAMP,OU=Organization,OU=Groups,OU=Ethos BeiJing,DC=ethos,DC=com,DC=cn)

或者查询在某个组内的用户

(objectCategory=user)(memberof=CN=LAMP,OU=Organization,OU=Groups,OU=Ethos BeiJing,DC=ethos,DC=com,DC=cn)

更多一些的查询方式请自己尝试

(|(department=Sales)(company=north)(description=north))
(|(objectcategory=user)(objectcategory=group)(objectcategory=contact))(|(description=North*)(company=North*))

(objectCategory=computer)
(objectCategory=computer)(!description=*)

(objectCategory=group)(!member=*)
(objectCategory=group)(samaccountname=*service*)
(objectCategory=group)(samaccountname=*admin*)

(objCategory=group)(description=*)
(objectCategory=group)(|(cn=Domain*)(cn=enter*))
(groupType:1.2.840.113556.1.4.803:=4)
(groupType:1.2.840.113556.1.4.803:=8)
(groupType:1.2.840.113556.1.4.804:=14)
(groupType:1.2.840.113556.1.4.804:=14)(!member=*)

查询用户

(objectcategory=user)(cn=David*)
(objectcategory=user)(|(cn=David*)(cn=Dana*))
(objectCategory=person)(objectClass=user)(name=*)
(objectCategory=person)(description=*service*)
(objectCategory=person)(samaccountname=*service*)
(objectCategory=person)(!employeeid=*)
(objectCategory=person)(!scriptPath=*)
(objectCategory=person)(!profilepath=*)
(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=65536)
(objectCategory=person)(objectClass=user)(pwdlastset=0)(!userAccountControl:1.2.840.113556.1.4.803:=2)
(objectCategory=person)(objectClass=user)(!userAccountControl:1.2.840.113556.1.4.803:=2)
(objectCategory=person)(objectClass=user)(!userAccountControl:1.2.840.113556.1.4.803:=16)
(objectcategory=user)(|(mobile=050*)(mobile=051*))
(objectcategory=user)(userAccountControl:1.2.840.113556.1.4.803:=65536)

根据邮箱属性查询用户

(objectCategory=person)(mail=*)
(objectCategory=person)(!mail=*)
(objectClass=user)(email=*)

根据状态查询用户

(objectCategory=person)(whenCreated>=20080801000000.0Z)
(objectCategory=person)(!cn=sara*)
(objectCategory=person)(badPwdCount>=2)
(objectCategory=person)(objectClass=user)(pwdLastSet<=127204308000000000)
(objectCategory=person)(objectClass=user)(|(lastLogon=0)!(lastLogon=*))
(objectCategory=user)(pwdLastSet=0)
(objectCategory=user)(msNPAllowDialin=TRUE)

根据组查询用户
(objectCategory=user)(memberof=CN=LAMP,OU=Organization,OU=Groups,OU=AAA,DC=AAA,DC=com)

Advertisements
 
Leave a comment

Posted by on March 17, 2009 in Windows Server

 

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
%d bloggers like this: