LDAP Search query to get only "Admin account" should not get "-da" accounts

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

LDAP Search query to get only “Admin account” should not get “-da” accounts.
please suggest a LDAP search query filter for configuration.

2

try this:

(&(objectClass=user)(sAMAccountName=*)(memberof=CN=Domain Admins,OU=Users,DC=subdomain,DC=domain,DC=com))

put you domain path

3

Hi @mrahulbb ,

what do you mean by -da accounts ?

Directory Admin ? what is -da accounts particularity in your LDAP, i mean an attribute value from you can identity them ? and same question for “Admin Account” in your LDAP ?

4

For example DA means Domian admin …we need to get admin accounts which consist of 4 types of admin accounts in that DA is of them it should not get into the accounts list.

5

How can we use not equal to in this filter

6

Not equals can be done with :

(!(yourfilter))

(&(objectClass=user)(memberof=CN=Domain Admins,OU=Users,DC=subdomain,DC=domain,DC=com)(!(sAMAccountName=*-da*)))
1 Like
7

Hi @mrahulbb -

It’s tough to provide an exact query without seeing the exact structure.
Here is an example though with the ‘not equal filter’ -

(&(objectClass=user)(objectCategory=person)(memberOf=CN=Administrators,CN=Builtin,DC=domain,DC=com)(!samAccountName=*-da))

Keep in mind that you cannot use the ! (Not operator) with organizational units (OUs) directly.

Regards,

1 Like
8

Hi, I does not understand what is your goal, but if you want to search accounts which belongs to some admin groups, AND are not members of domain admin group, it is not too simple. That is because the memberOf object has LDAP DN syntax (2.5.5.1) which has restricted search filter syntax (only “exacts”), that means that you can not search by memberof=cn=admin

If you have a list of your possible admin groups, if can be done using a filter like:
(memberOf=adminDN1 OR memberOf=adminDN2 OR…memberOf=adminDNn) AND memberOf != cn=domain admins…

In LDAP, that is:

(&(|(memberof=CN=YourAdminGroup1,CN=Users,DC=xxxxx)(memberof=CN=YourDomainAdminGroup2,CN=Users,DC=xxxxx)…(memberof=CN=YourDomainAdminGroupN,CN=Users,DC=xxxxx))(!(memberof=CN=Domain Admins,CN=Users,DC=xxxxx)))

9

We have -adms, -da , -sop, -sp in admin account so we dont want to get -da account in the source any ldap query

10

For AZURE AD aggregation filter query for the same?

11

No is different.
In Azure AD the structure is little different and SP uses different filter, you can find examples and explanation on the guide:

see this topic too:

12

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.