https://community.splunk.com/t5/Splunk-Search/How-to-use-the-splunk-ldapsearch-app-to-list-all-users/m-p/616240#M214178 <P>There is an app and add-on forum&nbsp;<A href="https://community.splunk.com/t5/All-Apps-and-Add-ons/bd-p/apps-add-ons-all" target="_blank">All Apps and Add-ons</A>. &nbsp;That's a better place to ask this question. &nbsp;To construct a useful search, you need to know how AD implements group membership. (In plain LDAP, group membership is often implemented with the attribute "MemberOf", but not always.)</P> Thu, 06 Oct 2022 22:55:39 GMT yuanliu 2022-10-06T22:55:39Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-splunk-ldapsearch-app-to-list-all-users/m-p/616230#M214176 <P>I am having no luck listing users' memberships with in a group, using ldapsearch.</P><P>I am not an AD LDAP expert, either.</P><P>Lets say I have a domain called Foo, and an OU (group) called Bar, with 10 users.&nbsp; Each user has additional memberships to other groups.</P><P>I am looking to list the membership attr for each user.</P><P>I am starting with&nbsp;</P><LI-CODE lang="markup">| ldapsearch domain=default search="(&amp;(objectClass=user))"... but I don't know what to add.</LI-CODE><P>Thank you&nbsp;</P> Thu, 06 Oct 2022 21:02:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-splunk-ldapsearch-app-to-list-all-users/m-p/616230#M214176 Glasses2 2022-10-06T21:02:25Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-splunk-ldapsearch-app-to-list-all-users/m-p/616240#M214178 <P>There is an app and add-on forum&nbsp;<A href="https://community.splunk.com/t5/All-Apps-and-Add-ons/bd-p/apps-add-ons-all" target="_blank">All Apps and Add-ons</A>. &nbsp;That's a better place to ask this question. &nbsp;To construct a useful search, you need to know how AD implements group membership. (In plain LDAP, group membership is often implemented with the attribute "MemberOf", but not always.)</P> Thu, 06 Oct 2022 22:55:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-splunk-ldapsearch-app-to-list-all-users/m-p/616240#M214178 yuanliu 2022-10-06T22:55:39Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-splunk-ldapsearch-app-to-list-all-users/m-p/616246#M214180 <P>Thank you, useful information re: app forum.</P><P>&nbsp;</P><P>However, despite a lack of decent documented examples, I stumbled across a way...</P><P>The users were in an OU group.</P><P>This worked&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">| ldapsearch basedn="OU=foobar accounts,DC=foo,DC=bar" search="(objectClass=user)" | table displayName dn memberOf</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>But unfortunately attrs=displayName,memberOf did not</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">| ldapsearch basedn="OU=foobar accounts,DC=foo,DC=bar" search="(objectClass=user)" attrs=displayName,memberOf | table displayName dn memberOf</LI-CODE><P>&nbsp;</P><P>I could not get both attrs, only the first in the list.&nbsp; Strange</P><P>&nbsp;</P><P>&nbsp;</P> Thu, 06 Oct 2022 23:59:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-splunk-ldapsearch-app-to-list-all-users/m-p/616246#M214180 Glasses2 2022-10-06T23:59:14Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-splunk-ldapsearch-app-to-list-all-users/m-p/616313#M214206 <P>Apparently wrapping attrs=" thing, thing2, thing3" in quotes works.</P> Fri, 07 Oct 2022 13:14:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-splunk-ldapsearch-app-to-list-all-users/m-p/616313#M214206 Glasses2 2022-10-07T13:14:01Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-splunk-ldapsearch-app-to-list-all-users/m-p/616342#M214212 <P>one other thing, if you are not admin, you need your role to include:&nbsp;</P><P>&nbsp;</P><P>list_settings</P><P>list_storage_passwords</P><P>&nbsp;</P><P>or you may get a permission denied error.</P> Fri, 07 Oct 2022 15:57:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-splunk-ldapsearch-app-to-list-all-users/m-p/616342#M214212 Glasses2 2022-10-07T15:57:56Z