All Apps and Add-ons

ldapsearch not getting all key/properties/fields from AD

bohrasaurabh
Communicator

In our environment when we run the powershell command to get a user's properties on AD server by running the below command we get 168 keys/properties/fields

Get-ADUser <username> -Properties *

However when I use ldapsearch command from Splunk for the same user I only get 83 properties.
| ldapsearch domain=mydomain search="(&(objectClass=user)(sAMAccountName=username))"

Some of the properties which are missing and we are interested are accountExpires, badPwdCount, scriptPath which are mentioned in the below question.

http://answers.splunk.com/answers/206725/ldapsearch-is-not-parsing-info-back-from-ad-well.html

I am seeing the above scenario on both (1.1.13 and 2.1.1) release of SA-ldapsearch. Am I missing some configuration which will fetch the missing properties?

0 Karma

lmaclean
Path Finder

Hi Kozanic,

Not sure why it only returns some results if doing just a basic search but if the attribute is in the LDAP schema then ldapsearch will pick it up, you just need to place the extra fields into a table output

e.g.

| table sAMAccountName, personalTitle, displayName, ..., pwdLastSet, badPasswordTime, badPwdCount, logonCount, etc....
0 Karma

Kozanic
Path Finder

Thanks.

I actually found that the port you use to query on also affects the number of attributes returned.

I think the default returns less - but is slightly faster. I have updated to use port 389 which seems to return a lot more - but does take a little longer.

Kozanic
Path Finder

Hi bohrasaurabh,

Just wondering if you ever figured this one out?

0 Karma
Get Updates on the Splunk Community!

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...