ldapsearch Cheatsheet

Command-line tool for querying LDAP directories. Part of the OpenLDAP suite.

Basic Syntax

ldapsearch [options] [filter] [attributes...]

Option	Description	Example
`-h HOST`	LDAP server hostname (deprecated, use `-H`)	`-h 172.16.5.5`
`-H URI`	LDAP URI	`-H ldap://172.16.5.5`
`-p PORT`	Port (default: 389, LDAPS: 636)	`-p 389`
`-x`	Simple authentication (instead of SASL)
`-D BINDDN`	Bind DN (username)	`-D "CN=admin,DC=domain,DC=local"`
`-w PASS`	Bind password	`-w Password123`
`-W`	Prompt for password
`-Z`	Start TLS
`-ZZ`	Require TLS (fail if unavailable)

Option	Description	Example
`-b BASEDN`	Search base DN	`-b "DC=DOMAIN,DC=LOCAL"`
`-s SCOPE`	Search scope: `base`, `one`, `sub`	`-s sub`
`-f FILE`	Read filters from file
`-l TIMELIMIT`	Time limit (seconds)	`-l 30`
`-z SIZELIMIT`	Size limit (entries)	`-z 1000`
`-LLL`	Minimal output (no comments, version)

Filter	Description
`(objectclass=user)`	All user objects
`(objectclass=computer)`	All computer objects
`(objectclass=group)`	All group objects
`(&(objectclass=user)(sAMAccountName=jsmith))`	Specific user
`(&(objectclass=user)(memberOf=CN=Domain Admins,CN=Users,DC=domain,DC=local))`	Domain Admins
`(&(objectclass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))`	Enabled accounts only
`(sAMAccountType=805306368)`	Normal user accounts

ldapsearch -h 172.16.5.5 -x -b "DC=DOMAIN,DC=LOCAL" -s sub "(&(objectclass=user))" sAMAccountName | grep sAMAccountName: | cut -f2 -d" "

ldapsearch -h 172.16.5.5 -x -b "DC=DOMAIN,DC=LOCAL" -s sub "*" | grep -m 1 -B 10 pwdHistoryLength

ldapsearch -h 172.16.5.5 -x -s base namingcontexts

ldapsearch -H ldap://172.16.5.5 -x -D "CN=admin,DC=domain,DC=local" -w Password123 -b "DC=DOMAIN,DC=LOCAL" "(&(objectclass=user))" sAMAccountName

ldapsearch -H ldap://172.16.5.5 -x -D "user@domain.local" -w Password123 -b "DC=DOMAIN,DC=LOCAL" -LLL "(objectclass=user)" cn sAMAccountName

Attribute	Description
`sAMAccountName`	Logon name
`userPrincipalName`	UPN (user@domain)
`cn`	Common name
`distinguishedName`	Full DN path
`memberOf`	Group memberships
`userAccountControl`	Account flags (enabled/disabled, etc.)
`pwdLastSet`	Last password change
`lastLogon`	Last logon timestamp
`lockoutTime`	Account lockout time
`badPwdCount`	Failed password attempts
`minPwdLength`	Minimum password length (domain-level)
`lockoutThreshold`	Lockout threshold (domain-level)
`pwdHistoryLength`	Password history length (domain-level)
`pwdProperties`	Password complexity flags (domain-level)

Attribute	Description
`minPwdLength`	Minimum password length
`maxPwdAge`	Maximum password age
`minPwdAge`	Minimum password age
`pwdHistoryLength`	Password history length
`pwdProperties`	0 = no complexity, 1 = complexity enabled
`lockoutThreshold`	Bad password attempts before lockout
`lockoutDuration`	Lockout duration (in 100-nanosecond intervals, negative)
`lockOutObservationWindow`	Lockout counter reset window

Use -LLL for clean, parseable output
Pipe through grep, awk, or cut to extract specific fields
Anonymous binds are a legacy config (disabled by default since Windows Server 2003)
Use -H ldap:// instead of the deprecated -h flag in newer versions