Searching Active Directory Using DSQUERY and LDAP Query

Here are some useful DSQUERY and LDAP query commands to search Active Directory.  

The following query lists all users with dial-In access permission (allow) in Active Directory: 

Using LDAP custom query - (&(objectClass=User)(objectCategory=Person)(msNPAllowDialin=TRUE))

Using DSQUERY command:

Dsquery * -filter ("&(objectClass=User)(objectCategory=Person)(msNPAllowDialin=TRUE)") -attr name

The following query lists all enabled user account that have never been logged into before: 

LDAP Query - (&(objectCategory=person)(objectClass=user)(!userAccountControl:1.2.840.113556.1.4.803:=2)(!lastLogonTimeStamp>=1))

Using DSQUERY Command:

dsquery * -filter ("&(objectCategory=person)(objectClass=user)(!userAccountControl:1.2.840.113556.1.4.803:=2)(!lastLogonTimeStamp>=1))" –limit 0 -attr name description

Read More

Testing Exchange Recipient Policy Filter using LDIFDE

Here is procedure which I used to test the Exchange Recipient Policy Filter manually. I have used the Ldifde.exe tool to perform this task.

Here is the syntax I used:

Ldifde -s <DC Name> -r "<Paste your Filter here>" -f <Output File Name> -l samaccountname

Also, you can see the ldifde syntax and details in the following KB article:

http://support.microsoft.com/kb/237677

Read More

How to Import and Export Directory Objects Using LDIFDE command

You can use the Ldifde.exe utility to export all directory objects to an .ldf file. The following command searches Houston OU and creates a file called exportdirectory.ldf containing those objects and its attributes:

Export Command ldifde -m -f c:\exportdirectory.ldf -d "OU=Houston,dc=Sivarajan,dc=Lab"

This command will export all the directory objects inside Houston OU to exportdirectory.ldf file.

The reason I used "-m" switch is, it will automatically strip all system-owned attributes when exporting the objects.   If you don't use "-m" or filter using "-r" or "-o" option, you will get the following error message when you try to import the objects into Active Directory

"Unwilling to perform. The modification was not permitted for security reasons"

Import Command

ldifde -i -f c:\exportdirectory.ldf

Also, you can use CSVDE command to import and export Active Directory objects.

Export Using CSVDE command

csvde -f c:\exportdirectory.csv -d "OU=Houston,dc=Sivarajan,dc=Lab"

Import Using CSVDE command

csvde -i -f c:\exportdirectory.csv

Read More