Splunk Search

ldapsearch not returning true/false for attr Enabled

marceloalejandr
Path Finder

For some reason the "Enabled" field is not return "true or false" when running ldapsearch from Splunk.  All the other fields return like sAMAccountName, cn, distinguishedName, etc but all the different combination tried so far have not returned value in the field.  We have confirmed there is a value in the field using cmdlet "get-aduser" so there is either a true or false for all users.   Here is an example of an ldapsearch query we've tried:

"| ldapsearch domain="x.xx.xxx.com" search="(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=512)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))" attrs="sAMAccountName, name, cn, co, st, whenCreated, accountExpires, Enabled, lastLogonTimestamp, title, physicalDeliveryOfficeName, manager, userAccountControl, distinguishedName, userPrincipalName"
| table sAMAccountName, name, cn, lastLogonTimestamp, Enabled, distinguishedName,userPrincipalName"

Any assistance is greatly appreciated.

Labels (1)
Tags (1)
0 Karma

marceloalejandr
Path Finder

In case anyone runs into this issue/question. the following ldapsearch returns all records that are Enabled =true.  However the Enabled field does not contain the value "true".   A second or follow-on eval statement to add the value "true" will be needed if this is what your report needs to show.   To see records that are Enabled=false change the "!" to "&" in the userAccountControl string.  

For records with Enabled=false use (&(userAccountControl:1.2.840.113556.1.4.803:=2)
For record with Enabled=true use (!(userAccountControl:1.2.840.113556.1.4.803:=2)

I hope this helps.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...