Search code examples
active-directoryldap

Pure ldap query to search useraccountcontrol with DONT_EXPIRE_PASSWORD flag set


I'm trying to use ldapsearch command to search for accounts with DONT_EXPIRE_PASSWD flag set:

enter image description here

Since LDAP query syntax does not support binary AND op, what should I use on userAccountControl property?

I can't use Get-AdUser PowerShell commandlet, I need an LDAP query.


Solution

  • LDAP does support binary AND operation, e.g

    (&(objectCategory=Person)(UserAccountControl:1.2.840.113556.1.4.803:=65536))