LDAP Queries – AMSD Blog

Search filters enable you to define search criteria and provide more efficient and effective searches.

These search filters are represented by Unicode strings.

The directory sync utility uses the LDAP query language to gather information from your directory server. The LDAP query language is a flexible standard that supports complex and powerful logical queries.

The following syntax is used in LDAP filters:


Name of Operator	Character	Use
Equals	=	Creates a filter which requires a field to have a given value.
Any	*	Wildcard to represent that a field can equal anything except NULL.
Parentheses	()	Separates filters to allow other logical operators to function.
And	&	Joins filters together. All conditions in the series must be true.
Or	\|	Joins filters together. At least one condition in the series must be true.
Not	!	Excludes all objects that match the filter.

For examples of how these operators are used, see the common LDAP queries below.

Common LDAP Queries

The examples below show the most common LDAP queries. These queries are the most common queries used, and are designed to work with most directory server environments.

All objects (this may cause load problems):

objectclass=*.

All user objects that are designated as a “person”

(&(objectclass=user)(objectcategory=person))

Distribution Lists only

(objectcategory=group)

Public Folders only

(objectcategory=publicfolder)

All user objects except for ones with primary email addresses that begin with test

(&(&(objectclass=user)(objectcategory=person))(!(mail=test*)))

All user objects except for ones with primary email addresses that end with test

(&(&(objectclass=user)(objectcategory=person))(!(mail=*test)))

All user objects except for ones with primary email addresses that contain the word “test”

(&(&(objectclass=user)(objectcategory=person))(!(mail=*test*)))

All user objects (users and aliases) that are designated as a “person” and all group objects (distribution lists)

(|(&(objectclass=user)(objectcategory=person))(objectcategory=group))

All user objects that are designated as a “person”, all group objects and all contacts, except those with any value defined for extensionAttribute9:

(&(|(|(&(objectclass=user)(objectcategory=person))(objectcategory=group))(objectclass=contact))(!(extensionAttribute9=*)))

All users, but exclude disabled users:

(&(&(objectclass=user)(objectcategory=person))(!(userAccountControl=514)))

Active Directory LDAP: All users

(objectClass=person)

Active Directory LDAP: All email users (alternate)