LDAP Queries

# PowerShell Commands Not included
# Great for ADUC Saved Queries 
##ADUC ##LDAP ##Queries ##UAC ##userAccountControl
###LDAP ##LDAPFilter ##LDAPQuery ##BAND ##Bitwise

Get-ADObject -Filter "(ObjectClass -eq 'User' -and -not ObjectClass -eq 'Computer')"
Get-ADObject -LDAPFilter "(&(ObjectClass=User)(!ObjectClass=Computer))"

# Accounts, Locked Accounts
(&(objectCategory=Person)(objectClass=User)(lockoutTime>=1))

# Accounts, Disabled
(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=2))

# Accounts, Enabled
(&(objectCategory=person)(objectClass=user)(name=name.*)(!userAccountControl:1.2.840.113556.1.4.803:=2))

#Accounts, Enabled
(&(objectCategory=person)(objectClass=user)(name=name.*)(!userAccountControl:1.2.840.113556.1.4.803:=2))

# Accounts, Password Not Expiring
# 
(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=65536))

# Security, Domain Admin (Groups)
(&(objectClass=Group)(memberOf=CN=Domain Admins,CN=Users,DC=,DC=,DC=))
(&(objectClass=Group)(memberOf=CN=Domain Admins,CN=Users,DC=ReleCloud,DC=com))

# Security, Domain Admin (Users)
(&(objectClass=User)(memberOf=CN=Domain Admins,CN=Users,DC=,DC=,DC=))
(&(objectClass=Group)(memberOf=CN=Domain Admins,CN=Users,DC=ReleCloud,DC=com))

# Security, Administrators Builtin (Groups)
(&(objectClass=Group)(memberOf=CN=Administrators,CN=Builtin,DC=,DC=,DC=))
(&(objectClass=Group)(memberOf=CN=Administrators,CN=Users,DC=ReleCloud,DC=com))

# Security, Administrators Builtin (Users)
(&(objectClass=User)(memberOf=CN=Administrators,CN=Builtin,DC=,DC=,DC=))
(&(objectClass=Group)(memberOf=CN=Administrators,CN=Users,DC=ReleCloud,DC=com))

# Accounts, Pre-Authentication
(&(objectclass=user)(objectcategory=user)(useraccountcontrol:1.2.840.113556.1.4.803:=4194304))

# Accounts, UAC ‘NOT_DELEGATED’ flag IS NOT Set
(&(objectCategory=person)(objectClass=User)(!userAccountControl:1.2.840.113556.1.4.803:=1048576))

# Accounts, UAC ‘NOT_DELEGATED’ flag IS Set
(&(objectCategory=person)(objectClass=User)(userAccountControl:1.2.840.113556.1.4.803:=1048576))

#Security Group
(&(objectClass=user)(memberOf=CN="",DC=,DC=,DC=))

# Computers, LAPS Not Enabled
# Computers, LAPS Not Enabled (Non Server, Enabled)
(&(ObjectClass=Computer)(!UserAccountControl:1.2.840.113556.1.4.803:=2)(!operatingSystem=Windows Server*)(!ms-Mcs-AdmPwd=*))

# Computers, LAPS not Enabled on Servers
(&(ObjectClass=Computer)(!UserAccountControl:1.2.840.113556.1.4.803:=2)(operatingSystem=Windows Server*)(!ms-Mcs-AdmPwd=*))

# Computers, LAPS
# Search for Local Administrator Password Solution (LAPS) values. Permissions are Required.
(&(ObjectClass=Computer)(ms-Mcs-AdmPwd=*))