4 minute read

Updated: 2013/03/29

Active Directory Users and Computers provides a Saved Queries folder in which administrators can create, edit, save, and organize saved queries. Before saved queries, administrators were required to create custom ADSI scripts that would perform a query on common objects. This was an often lengthy process that required knowledge of how ADSI utilizes LDAP search filters to resolve a query.

All queries located in the Saved Queries folder are stored in Active Directory Users and Computers (dsa.msc). Once you have successfully created your customized set of queries you can copy the .msc file to other domain controllers (located in the same domain) and use the same set of saved queries. You can also export saved queries to an .xml file and import them into other Active Directory User and Computer consoles located on domain controllers (within the same domain)

LDAP Syntax

LDAP Queries

Windows XP Computers with Service Pack 2 Installed

(&(objectCategory=computer)(operatingSystem=Windows XP Professional)(operatingSystemServicePack=Service Pack 2))

Windows XP Computers with Service Pack 1 Installed

(&(operatingSystem=Windows XP*l)(operatingSystemServicePack=Service Pack 1)))

Windows XP Computers with No Service Pack Installed

Notice the “!” before operating SystemServicePack and the “*”. The “!” means NOT so the statement reads “NOT equal to anything” instead of NULL or empty quotes (””) like some other languages. (&(operatingSystem=Windows XP Professional)(!operatingSystemServicePack=*)))

Windows Server 2003 No Service Pack 1

(&(objectCategory=computer)(operatingSystem=Windows Server 2003)(!operatingSystemServicePack=*))

Windows Server 2003 Service Pack 1 Installed

(&(objectCategory=computer)(operatingSystem=Windows Server 2003)(operatingSystemServicePack=Service Pack 1))

Windows 2000 Professional

(&(objectCategory=computer)(operatingSystem=Windows 2000 Professional))

Windows 2000 Server

(&(objectCategory=computer)(operatingSystem=Windows 2000 Server))

All Windows Server 2003 Servers

(&(objectCategory=computer)(operatingSystem=Windows Server 2003))

SQL Servers (running on Windows 2003) (please verify in your environment)

(&(objectCategory=computer)(servicePrincipalName=MSSQLSvc*)(operatingSystem=Windows Server 2003))

SQL Servers any Windows Server OS

(&(objectCategory=computer)(servicePrincipalName=MSSQLSvc*)(operatingSystem=Windows Server*))

Exchange Servers (running on Windows 2003) (please verify in your environment)

(&(objectCategory=computer)(servicePrincipalName=exchangeMDB*)(operatingSystem=Windows Server 2003))

Exchange Servers any Windows Server OS

(&(objectCategory=computer)(servicePrincipalName=exchangeMDB*)(operatingSystem=Windows Server*))

Windows Vista SP1

(&(objectCategory=computer)(operatingSystem=Windows Vista*)(operatingSystemServicePack=Service Pack 1))

Windows Server 2008 Enterprise

(&(objectCategory=computer)(operatingSystem=Windows Server® 2008 Enterprise)(operatingSystemServicePack=Service Pack 1))

Windows Server 2008 (all versions)

(&(objectCategory=computer)(operatingSystem=Windows Server® 2008*)) Notice the ® in the Windows 2008 values, it needs to be in the query or there won’t be any results.

Groups Like Service (finds any group name that contains the word service)


Description Like Service (finds accounts in which the description contains the word service)


Groups Like Admin (finds any groups whose name contains the word admin)


Universal Groups (finds groups with universal scope)


Groups with No Members (finds groups that have no members in them)

(objectCategory=group)(!member=*) Note: The ! symbol means “Not” and * means “Has a value,” so the combination of the two evaluates to “Doesn’t have a value.”

Global, Domain Local, or Universal Groups (finds any group defined as a Global Group, a Domain Local Group, or a Universal Group)


Global Group, a Domain Local Group, or a Universal Group that has no members)


User Like Service (finds any account ID that has a name containing the word service)


Password Does Not Expire (finds user accounts with nonexpiring passwords)


No Employee ID (finds any user account that has no employeeid value)


No Login Script (finds accounts that don’t run a logon script)


No Profile Path (finds accounts that don’t have roaming profiles)


Must Change Password and Not Disabled (finds nondisabled accounts that must change their password at next logon)


UserList Exclude Disabled Account (finds all user accounts except those that are disabled)


Locked Out Accounts (finds all locked out accounts)


Domain Local Groups (finds groups with Domain Local scope)


Users with Email Address (finds accounts that have an email address)


Users with No Email Address (finds accounts with no email address)


Find Groups that contains the word admin


Find users who have admin in description field


Find all Universal Groups


Empty Groups with No Members


Finds all groups defined as a Global Group, a Domain Local Group, or a Universal Group


Find all User with the name Bob


Find user accounts with passwords set to never expire


Find all users that never log in to domain


Find user accounts with no log on script


Find user accounts with no profile path


Finds non disabled accounts that must change their password at next logon


Finds all disabled accounts in active directory


Finds all locked out accounts


Finds Domain Local Groups


Finds all Users with Email Address set


Finds all Users with no Email Address


Find all Users, Groups or Contacts where Company or Description is Contractors


Find all Users with Mobile numbers 712 or 155


Find all Users with Dial-In permissions


Find All printers with Color printing capability

Note: server name must be changed (&(&(&(uncName=*Servername*)(objectCategory=printQueue)(printColor=TRUE))))

Find Users Mailboxes Overriding Exchange Size Limit Policies


Find all Users that need to change password on next login.


Find all Users that are almost Locked-Out

Notice the “>=” that means “Greater than or equal to”. (objectCategory=user)(badPwdCount>=2)

Find all Computers that do not have a Description


Find all users with Hidden Mailboxes


Find all Windows 2000 SP4 computers

(&(&(&(objectCategory=Computer)(operatingSystem=Windows 2000 Professional)(operatingSystemServicePack=Service Pack 4))))

Find all Windows XP SP2 computers

(&(&(&(&(&(&(&(objectCategory=Computer)(operatingSystem=Windows XP Professional)(operatingSystemServicePack=Service Pack 2))))))))

Find all Windows XP SP3 computers

(&(&(&(&(&(&(&(objectCategory=Computer)(operatingSystem=Windows XP Professional)(operatingSystemServicePack=Service Pack 3))))))))

Find all Vista SP1 computers

(&(&(&(&(sAMAccountType=805306369)(objectCategory=computer)(operatingSystem=Windows Vista*)(operatingSystemServicePack=Service Pack 1)))))

Find All Workstations


Find all 2003 Servers Non-DCs

(&(&(&(samAccountType=805306369)(!(primaryGroupId=516)))(objectCategory=computer)(operatingSystem=Windows Server 2003*)))

Find all 2003 Servers – DCs

(&(&(&(samAccountType=805306369)(primaryGroupID=516)(objectCategory=computer)(operatingSystem=Windows Server 2003*))))

Find all Server 2008

(&(&(&(&(samAccountType=805306369)(!(primaryGroupId=516)))(objectCategory=computer)(operatingSystem=Windows Server 2008*))))

Find all user accounts that have the name “srv_acct” in them, if your service accounts follow a naming convention.


Find all groups that have no members


Find users that have non-expiring passwords.


Find users created between 2010-01-01 and 2011-01-01


Leave a comment