Searching Active Directory Using DSQUERY and LDAP Query

Here are some useful DSQUERY and LDAP query commands to search Active Directory.  

The following query lists all users with dial-In access permission (allow) in Active Directory: 

Using LDAP custom query - (&(objectClass=User)(objectCategory=Person)(msNPAllowDialin=TRUE))

Using DSQUERY command:

Dsquery * -filter ("&(objectClass=User)(objectCategory=Person)(msNPAllowDialin=TRUE)") -attr name

The following query lists all enabled user account that have never been logged into before: 

LDAP Query - (&(objectCategory=person)(objectClass=user)(!userAccountControl:1.2.840.113556.1.4.803:=2)(!lastLogonTimeStamp>=1))

Using DSQUERY Command:

dsquery * -filter ("&(objectCategory=person)(objectClass=user)(!userAccountControl:1.2.840.113556.1.4.803:=2)(!lastLogonTimeStamp>=1))" –limit 0 -attr name description

Read More

Group Membership – Batch File / Script

This batch file script can be used to list group membership details. You can add all user names (samaccoutname) to the input file -Users.txt. The output will be in the Output.txt file.

I created this script based on this question posted on the TechNet forum

FOR /f %%i in (C:\Users.txt) do (
Echo %%i >> output.txt
Dsquery user –samid %%i |dsget user -memberof –expand >> Output.txt
)

You can also see a PowerShell script on the following link:

http://portal.sivarajan.com/2010/08/list-group-members-in-active.html

Read More

Domain Services was unable to initialize network connections for incoming LDAP requests

I was getting the following error message when I was trying to mount the AD Snapshot using dsamain utility (http://technet.microsoft.com/en-us/library/cc753246(WS.10).aspx). 

You can see the official explanation on KB 959215 - http://support.microsoft.com/kb/959215

My solution was to use a different port.  I randomly selected a port and I was able to successfully mount the snapshot.

Read More