Since I started this little investigation of LDAP today, I decided to look into using the ldapsearch command in linux to display Windows Active Directory attributes and information. This is a bit of what I came up with:<\/p>\n
# ldapsearch -x -LLL -E pr=someinteger<\/em>\/noprompt -h host<\/em> -D ‘adsuser@mydomain.com<\/em>‘ -W -b “searchbase<\/em>”<\/p>\n Some explanation:<\/p>\n someinteger<\/em>: Because of the “noprompt” switch, this number is not really important. All matching entries will be displayed. You can set it some integer with a “prompt” switch, and only that number of entries will be displayed before you are prompted for more. The -E option is available in later versions of openldap. I tested version 2.3. It is not an option in 2.0.<\/p>\n adsuser@mydomain.com<\/em>: This can be any user account in the directory, because they have read only access to the directory. I used the -W option to prompt me to enter my password, however you can use the -w option and pass it your ADS password on the command line.<\/p>\n searchbase<\/em>: The search base is where things get interesting. You can use something like the following to search for only users:<\/p>\n # ldapsearch -x -LLL -E pr=someinteger<\/em>\/noprompt -h host<\/em> -D ‘adsuser@mydomain.com<\/em>‘ -W -b “cn=users,dc=mydomain,dc=com<\/em>”<\/p>\n Or computers: Or everything under DC=mydomain,DC=com:<\/p>\n # ldapsearch -x -LLL -E pr=someinteger<\/em>\/noprompt -h host<\/em> -D ‘adsuser@mydomain.com<\/em>‘ -W <\/p>\n You can also filter for certain distinguished names:<\/p>\n This will display attributes and values for all relative distinguished names:<\/p>\n # ldapsearch -x -LLL -E pr=someinteger<\/em>\/noprompt -h host<\/em> -D ‘adsuser@mydomain.com<\/em>‘ -W -b “cn=users,dc=mydomain,dc=com<\/em>” -s sub “(cn=*)”<\/p>\n This will display all relative distinguished names that start with the letter “z” under the users distinguished name:<\/p>\n # ldapsearch -x -LLL -E pr=someinteger<\/em>\/noprompt -h host<\/em> -D ‘adsuser@mydomain.com<\/em>‘ -W -b “cn=users,dc=mydomain,dc=com<\/em>” -s sub “(cn=z*)”<\/p>\n Fun stuff, but not exactly sure what I would do with this information. Maybe access ADS information without having to login to Windows. <\/p>\n","protected":false},"excerpt":{"rendered":" Since I started this little investigation of LDAP today, I decided to look into using the ldapsearch command in linux to display Windows Active Directory attributes and information. This is a bit of what I came up with: # ldapsearch -x -LLL -E pr=someinteger\/noprompt -h host -D ‘adsuser@mydomain.com‘ -W -b “searchbase” Some explanation: someinteger: Because [&hellip<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[82,83,245],"class_list":["post-696","post","type-post","status-publish","format-standard","hentry","category-documentation","tag-active-directory","tag-ads","tag-ldap"],"share_on_mastodon":{"url":"","error":""},"_links":{"self":[{"href":"https:\/\/jim-zimmerman.com\/index.php?rest_route=\/wp\/v2\/posts\/696","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jim-zimmerman.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jim-zimmerman.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jim-zimmerman.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/jim-zimmerman.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=696"}],"version-history":[{"count":1,"href":"https:\/\/jim-zimmerman.com\/index.php?rest_route=\/wp\/v2\/posts\/696\/revisions"}],"predecessor-version":[{"id":697,"href":"https:\/\/jim-zimmerman.com\/index.php?rest_route=\/wp\/v2\/posts\/696\/revisions\/697"}],"wp:attachment":[{"href":"https:\/\/jim-zimmerman.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=696"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jim-zimmerman.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=696"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jim-zimmerman.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=696"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n# ldapsearch -x -LLL -E pr=someinteger<\/em>\/noprompt -h host<\/em> -D ‘adsuser@mydomain.com<\/em>‘ -W -b “cn=computers,dc=mydomain,dc=com<\/em>”<\/p>\n