topic Re: AD Base Filter syntax in Getting Data In

AD Base Filter syntax

twgtech — Mon, 04 Oct 2010 18:41:54 GMT

I am using the "Map users directly" config from here -

http://www.splunk.com/base/Documentation/4.1.5/Admin/SetupuserauthenticationwithLDAP#Test_your_LDAP_configuration

in order to get around referrals in an AD forest with multiple child domains.

Everything is working well, in fact, too well. It is returning all objects, even though my (objectclass=user) is set (I tried people as well. no change).

My question is how can I filter out the computer objects that get returned? Ideally, I'd like to remove everything with a $ in the name. I've tried piping !objectclass=computer into it with no success.

Re: AD Base Filter syntax

ziegfried — Mon, 04 Oct 2010 19:22:04 GMT

One option is to use the userAccountControl flag to query user accounts:

(&(objectclass=user)(userAccountControl:1.2.840.113556.1.4.803:=512))

(the UAC flag 512 means NORMAL_ACCOUNT)

Your suggestion of filtering accounts with $ in its name would work as well:

(&(!(sAMAccountName=*$*))(objectclass=user))

Re: AD Base Filter syntax

twgtech — Mon, 04 Oct 2010 20:58:25 GMT

DOH! No wonder my query wasn't working. I didn't correctly paren it. Thanks for the examples. A quick shuffle and it's doing exactly what I need.

Thanks much, ziegfried.

Re: AD Base Filter syntax

gkanapathy — Mon, 04 Oct 2010 23:10:21 GMT

Usually in AD, you want (&(ObjectCategory=Person)(objectclass=user)).

Re: AD Base Filter syntax

twgtech — Tue, 05 Oct 2010 20:31:01 GMT

Thanks, gkanapathy. That works as well. now if I can only get it to distiguish between the same sAMAccountName from different domains. I'll be creating a new question for that one.