ldapsearch not returning true/false for attr Enabled

[marceloalejandr]

For some reason the "Enabled" field is not return "true or false" when running ldapsearch from Splunk.  All the other fields return like sAMAccountName, cn, distinguishedName, etc but all the different combination tried so far have not returned value in the field.  We have confirmed there is a value in the field using cmdlet "get-aduser" so there is either a true or false for all users.   Here is an example of an ldapsearch query we've tried:

"| ldapsearch domain="x.xx.xxx.com" search="(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=512)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))" attrs="sAMAccountName, name, cn, co, st, whenCreated, accountExpires, Enabled, lastLogonTimestamp, title, physicalDeliveryOfficeName, manager, userAccountControl, distinguishedName, userPrincipalName"
| table sAMAccountName, name, cn, lastLogonTimestamp, Enabled, distinguishedName,userPrincipalName"

Any assistance is greatly appreciated.

[marceloalejandr]

In case anyone runs into this issue/question. the following ldapsearch returns all records that are Enabled =true.  However the Enabled field does not contain the value "true".   A second or follow-on eval statement to add the value "true" will be needed if this is what your report needs to show.   To see records that are Enabled=false change the "!" to "&" in the userAccountControl string.  

For records with Enabled=false use (&(userAccountControl:1.2.840.113556.1.4.803:=2)
For record with Enabled=true use (!(userAccountControl:1.2.840.113556.1.4.803:=2)

I hope this helps.