Unfortunately you cannot use contructed attributes in LDAP query filters, so what you'll have to do is filter on the first two statements: (&(!userAccountControl:1.2.840.113556.1.4.803:=2)(!userAccountControl:1.2.840.113556.1.4.803:=65536))īe sure to ask the directory server for the msDS-User-Account-Control-Computed value, and then perform your bitwise AND mask on the results, client-side. I haven't tested this, but if memory serves me right, this should help you reliably identify accounts with expired passwords with this filter: (&(msDS-User-Account-Control-Computed:1.2.840.113556.1.4.803:=8388608)) MsDS-User-Account-Control-Computed transparently returns the same value as userAccountControl, but with the addition of the following bits, computed on the fly at lookup time: UF_LOCKOUT 0x0010 To aid developers and integrators, Microsoft has implemented a dynamic attribute named msDS-User-Account-Control-Computed.

Likewise, a setting called DONT_EXPIRE_PASSWORD has value 65536 (0x10000), and we can find these accounts with: (&(userAccountControl:1.2.840.113556.1.4.803:=65536))Ĭalculating password expiration is a bit more complicated. To find Disabled accounts, we can use the following filter syntax: (&(userAccountControl:1.2.840.113556.1.4.803:=2))Īs always, you can negate an ldap expression with !, in this example retrieving all Enabled accounts: (!(userAccountControl:1.2.840.113556.1.4.803:=2)) Microsoft's LDAP implementation let's you filter such an attribute with bitwise operators, identified by an Object Identifier (OID):

UserAccountControl is a bitfield, and contains a long list of account security related settings, like 'User cannot change password' and account 'Disabled'. I would like to extract all Users whose employeeID is a number. Internally, they're derived from actual account attributes like userAccountControl and pwdLastSet. There is an user attribute called employeeID Two types of value can exist in the employeeID records, one that is pure whole number, and other would start with characters like NE. The ActiveDirectory module has clever logic that calculate 'popular' properties like whether a user account is Enabled or have PasswordNeverExpires set and presents them like regular attributes.

Ldap query user