Author Archives: NetTools

LDAP Search – Base DN Formats

Active Directory support a number of different formats for the Base DN field, these are Distinguished Name, GUID and SID 

Distinguished Name is based on RFC 4514 e.g. CN=user1,CN=users,DC=domain,DC=com

GUID provides the GUID of an object which will be used as the base for searches, i.e <GUID=01f04883-d68e-4367-8ad1-a2faa79a2e5a>

SID format is the same as GUID but the entry is based on a SID i.e. <SID=S-1-5-21-2816452191-2840564649-4223122534-1000>

The SID and GUID option with the Search Scope set to Base Level can be used as quick search for users or other objects in the AD based on the GUID or SID.  The SIDs and GUIDs are entered in standard readable format.

How To: Search for multiple users based on email address

This article show how to create an LDAP query that can be used to search for users based on an email or UPN.  The query uses Input Mode to allow a list of email\UPN to be searched at one time.  It will search for the user's email address in the mail, UPN and proxyaddresses attributes.

You will notice in the filter that the proxyaddresses section of search includes SMTP: in the filter, this is to ensure that only smtp entries are returned, but also to improve the performance of the search, rather than using wildcards.

Here is the Favorite, see Favorites for details on how to import this query into NetTools.

[User Mail Search]
Options=879892770722397
Server=
BaseDN=##default
Filter=(&(objectclass=user)(|(userPrincipalName=##input)(mail=##input)(proxyaddresses=stmp:##input)))
Attributes=displayname, userAccountControl,accountExpires, lastlogontimestamp
DisplayFilter=
Filename=
Sort=
Authentication=1158
Separator=,

Once the query has been imported and selected, paste a list of email addresses into the table view and click Go.

Related Items:

LDAP Search Options
Input Mode
Favorites
Saved Favorites

 

How To: Display the properties of the members of a group

This articles explains how to use the ASQ server side control to return the display name and email address of all the members of a specific group.

First go to the Search option under Users in the left hand pane, deselect the Return Users Only option, and then enter the name of the group in the username field, click Go.

Select the required group from the list of returned results and then right click on the item, from the context menu, select Use With -> LDAP Search.  This will populate the LDAP Search option with the details of the group.

Click on the More button, In the Server Side controls section, select the Attribute Scope Query option, and set the Search Scope to Base Level.

In the Attributes field enter, ‘Member, displayname, mail’ and click Go.

In this example we are only returning the display name and email address for the members, however, you can specify any of the user’s attributes you want to display, they just need to be added to the Attributes list.

With this example we don’t specifying which objects to return, we can restrict the results to only user accounts, by changing the filter to (objectclass=user) or (objectclass=group) to only return the groups that are members.

[Search]
Options=879892770981453
Server=NULL
BaseDN=
Filter=(objectclass=*)
Attributes=Member, displayname, mail
DisplayFilter=
Filename=
Sort=
Authentication=1158
Separator=,

Related items:

ASQ details
User Search
LDAP Search - Options
LDAP Favorties

LDAP Search – Enums

NetTools includes over 50 predefined enumeration to decode the values assigned to specific attributes, these include the definitions of associated values assigned to the attributes. An example would be the UserAccountControl attribute, which is shown below. To display the Enums dialog, click on the button at the end of the filter field.

The dialog can be used to browse the predefined entries and from the context menus, the values can then be used in filters.

There are two type of Enums defined in NetTools, Bit and Value.  The Bit enums are used for attributes that use a bit mask to define the function of the attribute, and a single bit in the value is used to represent an enabled or disabled state of an option.  The Value type is used for attributes that have a single value to represent the function.

The Enums are used by attributes that have the ATTRIBENUM or ATTRIBENUM_NONUM decode type assigned, the attribute name is then used to lookup the corresponding enums assigned to that attribute.  Currently there is no method for a user to add additional Enum to NetTools, they are statically defined in the program. 

How To: Display deleted objects

By default, objects deleted in Active Directory are not visible.  NetTools provides the ability to quickly and easily to display deleted and recycled objects.  From the LDAP Search click on the More button to display the Advanced options, select the Deleted and Recycled objects options.

Deleted

With these options selected, queries will include the Deleted Objects contain in searches.  Also with these options selected the LDAP Browser, and OU Selector will display the Deleted Objects Container.

To use these server side controls the user context that runs the query or browsing the directory, must have administrator rights.  You can use the Credentials option to specify a user context that has rights.

Related Items:

LDAP Search - Options
LDAP Search
LDAP Browser

LDAP Search – Credentials

Note: The Credentials option was deprecated in version 1.28.0 and replaced with Connection Profiles

LDAP Search provides the ability to specific the credentials under which a query will be executed, it also provides the ability to select the authentication method that will be used to pass the credentials to the server.

The Credentials dialog is found when the More button is pressed.

credentials

There are nine different authentication methods available:

LDAP_AUTH_SIMPLE, this method requires the DN of the account and password, domain is not required
LDAP_AUTH_DIGEST, Digest authentication package
LDAP_AUTH_DPA, Distributed password authentication. Used by Microsoft Membership System
LDAP_AUTH_MSN, Microsoft Network Authentication Service
LDAP_AUTH_NTLM, this method uses NTLM to authenticate against the directory
LDAP_AUTH_SICILY, covers package negotiation to MSN servers
LDAP_AUTH_DIGEST, this method requires the samaccountname and password
LDAP_AUTH_NEGOTIATE, this method requires either, samaccountname or UPN and password, the domain is optional
ANONYMOUS, the username and password are not required.

See the following MS Article for more details ldap_bind_s

Warning: With the simple bind method the password is sent in clear text to the server, you should use this method in association with an SSL based connection to protect the password.

The default behavior of NetTools is use the negotiate method, when connecting to an Active Directory, you don't need to provide any credentials, the current user's context will be used based on Kerberos authentication.

A number of other options in NetTools use the credentials provided in this dialog to run the option under a different or elevated set of credentials, this is shown as Use the LDAP Search Credentials.

Copy to new Window

The Copy to new Window context menu, provides the ability to copy the results from the current output pane in NetTools to a new separate detached window.  The new window provides the ability to sort and filter the view based on a number of selection criteria.

By right clicking on the column headers, the filter dialog box will be displayed.  This allows the entries in the column to be filtered based on a text filter or a contents selection.  You can select a text or context filter, or both.

filter

The Text Filter provides the following filter options:

      • Equals
      • Does not Equal
      • Begins With
      • Does not begin with
      • Ends with
      • Does not end with
      • Contains
      • Does not contain

The Column Filter section displays all the unique items in the column, using the check boxes you can select which items will be displayed. 

When a column filter is applied the heading of the column to appended with the text '- (filtered)'.  The Clear All button, will remove all the filters that have been applied. 

The filter function support up to a maximum of 200 columns, if the output field contains more than 200 columns, a warning message is displayed and filtering option is disabled.

LDAP Search – LDAP Filter Wizard

The LDAP Filter Wizard provides the ability to display and edit LDAP filters in a hierarchical view. 

The LDAP Filter Wizard provides the following features:

      • Drag and drop to move items around
      • Insert new operators and conditions
      • Change existing operators and conditions
      • Selection of classes and Attributes from dropdown list

The Operators, AND, OR, NOT, and Filter, have a dual function, one to show the operation of the currently selected item, and two to select the operation for the New and Change operations.  When the New Parent, or New Child buttons are pressed the new item will be added based on the selected Operator.  When the Change button is pressed the selected item will change to the selected Operator.  With the Filter Operator you can select the required attribute or class from the dropdown list, additional text can be added to complete the condition before the items is added.

The Delete Button will delete all items under the selected item.  If you wish to preserve any of the items under the selected items, they must be moved to another point in the filter before the item is deleted.

If you click twice on an items in the hierarchical view, it will allow you to edit the details of the item.

The MS LDAP API and NetTools will accept fully compliant RFC4515 Not statements or the abbreviated alternative.  With RFC4515 the Not statement must be constructed as such (!(condition)) i.e. (!(objectclass=user)), while the MS LDAP API will accept the abbreviated form of (!condition) i.e. (!objectclass=user).  When the RFC4515 option is selected the wizard will return compliant Not statements.  The LDAP Filter Wizard is able to read both formats.

The example shown is using a number of the substitution options, see LDAP Search Substitution

LDAP Search – Static DecodeTypes

NetTools defines a number attributes with of static DecodeTypes, this is the list of attributes that have been defined.  The internal constant is used in the list, this maps as DYN_DECODE_GUID to GUID in the attribute Decode list.   See DecodeTypes for more information

Atrtibute Assign DecodeType
accountExpires DYN_DECODE_64TIME
aelita-Amm-SourceGUID DYN_DECODE_GUID
aelita-Amm-SourceSID DYN_DECODE_SID
aelita-Amm-TargetGUID DYN_DECODE_GUID
aelita-Amm-TargetSID DYN_DECODE_SID
attributeCertificateAttribute DYN_DECODE_CERT
attributeSecurityGUID DYN_DECODE_GUID
attributeSyntax DYN_DECODE_ATTRIBENUM
auditPolicy DYN_DECODE_BINARY
badpasswordtime DYN_DECODE_64TIME
cacertificate DYN_DECODE_CERT
certificateRevocationList DYN_DECODE_CRL
createtimestamp DYN_DECODE_GTFTIME
creationtime DYN_DECODE_64TIME
crossCertificatePaie DYN_DECODE_CERT
currenttime DYN_DECODE_GTFTIME
deltaRevocationList DYN_DECODE_CRL
dnsproperty DYN_DECODE_BINARY
dnsrecord DYN_DECODE_DNSRECORD
domainControllerFunctionality DYN_DECODE_ATTRIBENUM
domainFunctionality DYN_DECODE_ATTRIBENUM
dsasignature DYN_DECODE_BINARY
dSASignature DYN_DECODE_DSA_SIG
dSCorePropagationData DYN_DECODE_GTFTIME
ForceLogoff DYN_DECODE_ATTRIBENUM
forestFunctionality DYN_DECODE_ATTRIBENUM
gpoptions DYN_DECODE_ATTRIBENUM
grouptype DYN_DECODE_ATTRIBENUM
IndSS-ActualDate DYN_DECODE_64DATE_UTC
IndSS-PlannedDate DYN_DECODE_64DATE_UTC
IndSS-TaskLastRun DYN_DECODE_64TIME_UTC
instancetype DYN_DECODE_ATTRIBENUM
Invocationid DYN_DECODE_GUID
lastLogon DYN_DECODE_64TIME
lastLogonTimestamp DYN_DECODE_64TIME
lockoutDuration DYN_DECODE_PWDSEC
lockOutObservationWindow DYN_DECODE_PWDSEC
lockoutTime DYN_DECODE_64TIME
lockoutTime DYN_DECODE_64TIME
maxPwdAge DYN_DECODE_PWDSEC
minPwdAge DYN_DECODE_PWDSEC
minPwdAge DYN_DECODE_PWDSEC
modifytimestamp DYN_DECODE_GTFTIME
msDFS-TargetListv2 DYN_DECODE_UNICODE
msds-behavior-version DYN_DECODE_ATTRIBENUM
mS-DS-ConsistencyGuid DYN_DECODE_GUID
msDS-LockoutDuration DYN_DECODE_PWDSEC
msDS-LockoutObservationWindow DYN_DECODE_PWDSEC
msds-ManagedPassword DYN_DECODE_GMSAPWD
msDS-ManagedPasswordId DYN_DECODE_GMSAPWDID
msDS-ManagedPasswordPreviousId DYN_DECODE_GMSAPWDID
msDS-MaximumPasswordAge DYN_DECODE_PWDSEC
msDS-MinimumPasswordAge DYN_DECODE_PWDSEC
msDS-ReplAttributeMetaData DYN_DECODE_META
msDS-ReplValueMetaData DYN_DECODE_METAV
msDS-RequiredForestBehaviorVersion DYN_DECODE_ATTRIBENUM
msDS-RequiredDomainBehaviorVersion DYN_DECODE_ATTRIBENUM
msds-SupportedEncryptionTypes DYN_DECODE_ATTRIBENUM
msDS-TrustForestTrustInfo DYN_DECODE_MSTRUST
msds-user-account-control-computed DYN_DECODE_ATTRIBENUM
msDS-UserPasswordExpiryTimeComputed DYN_DECODE_64DATE_UTC
msExchArchiveGUID DYN_DECODE_GUID
msExchMailboxGuid DYN_DECODE_GUID
msExchMailboxSecurityDescriptor DYN_DECODE_SD
msExchMasterAccountSid DYN_DECODE_SID
msExchOMAAdminWirelessEnable DYN_DECODE_ATTRIBENUM
msExchModerationFlags DYN_DECODE_ATTRIBENUM
msExchRecipientDisplayType DYN_DECODE_ATTRIBENUM
msExchRecipientTypeDetails DYN_DECODE_ATTRIBENUM
msExchRemoteRecipientType DYN_DECODE_ATTRIBENUM
msExchSafeSendersHash DYN_DECODE_BINARY
msexchuseraccountcontrol DYN_DECODE_ATTRIBENUM
msFVE-KeyPackage DYN_DECODE_BINARY
msFVE-VolumeGuid DYN_DECODE_GUID
msFVE-RecoveryGuid DYN_DECODE_GUID
msKds-CreateTime DYN_DECODE_64TIME
msKds-KDFParam DYN_DECODE_BINARY
msKds-RootKeyData DYN_DECODE_BINARY
msKds-SecretAgreementParam DYN_DECODE_BINARY
msKds-UseStartTime DYN_DECODE_64TIME
ms-Mcs-AdmPwdExpirationTime DYN_DECODE_64DATE_UTC
msMQDigests DYN_DECODE_BINARY
mSMQSignCertificates DYN_DECODE_BINARY
mspki-certificate-name-flag DYN_DECODE_ATTRIBENUM
mspki-enrollment-flag DYN_DECODE_ATTRIBENUM
mspki-private-key-flag DYN_DECODE_ATTRIBENUM
msrtcsip-archivedefaultflags DYN_DECODE_ATTRIBENUM
msrtcsip-archivingenabled DYN_DECODE_ATTRIBENUM
msrtcsip-archivingserverversion DYN_DECODE_ATTRIBENUM
msrtcsip-enablefederation DYN_DECODE_ATTRIBENUM
msrtcsip-meetingflags DYN_DECODE_ATTRIBENUM
msrtcsip-optionflags DYN_DECODE_ATTRIBENUM
msRTCSIP-OriginatorSid DYN_DECODE_SID
msrtcsip-poolfunctionality DYN_DECODE_ATTRIBENUM
msrtcsip-pooltype DYN_DECODE_ATTRIBENUM
msrtcsip-poolversion DYN_DECODE_ATTRIBENUM
msrtcsip-serverversion DYN_DECODE_ATTRIBENUM
msrtcsip-sourceobjecttype DYN_DECODE_ATTRIBENUM
msrtcsip-trustedserverversion DYN_DECODE_ATTRIBENUM
msrtcsip-ucflags DYN_DECODE_ATTRIBENUM
msRTCSIP-UserRoutingGroupId DYN_DECODE_GUID
mSSMSRangedIPHigh DYN_DECODE_IP_W
mSSMSRangedIPLow DYN_DECODE_IP_W
ntmixeddomain DYN_DECODE_ATTRIBENUM
ntsecuritydescriptor DYN_DECODE_SD
objectclasscategory DYN_DECODE_ATTRIBENUM
ObjectGUID DYN_DECODE_GUID
ObjectSID DYN_DECODE_SID
omobjectclass DYN_DECODE_BEROID
oMSyntax DYN_DECODE_ATTRIBENUM
pkidefaultkeyspec DYN_DECODE_ATTRIBENUM
pkiexpirationperiod DYN_DECODE_PERIOD
pkikeyusage DYN_DECODE_ATTRIBENUM
pkioverlapperiod DYN_DECODE_PERIOD
pktGUID DYN_DECODE_GUID
pwdLastSet DYN_DECODE_64TIME
pwdproperties DYN_DECODE_ATTRIBENUM_NONUM
replPropertyMetaData DYN_DECODE_METAP
repluptodatevector DYN_DECODE_BINARY
replUpToDateVector DYN_DECODE_REPL_UTDV
repsfrom DYN_DECODE_BINARY
repsfrom DYN_DECODE_REPSINFO
repsto DYN_DECODE_BINARY
repsto DYN_DECODE_REPSINFO
ridallocationpool DYN_DECODE_RIDPOOL
ridavailablepool DYN_DECODE_RIDPOOL
ridpreviousallocationpool DYN_DECODE_RIDPOOL
samaccounttype DYN_DECODE_ATTRIBENUM
schemaFlagsEx DYN_DECODE_ATTRIBENUM
schemaIDGUID DYN_DECODE_GUID
sdrightseffective DYN_DECODE_ATTRIBENUM
searchflags DYN_DECODE_ATTRIBENUM
securityIdentifier DYN_DECODE_SID
ServerState DYN_DECODE_ATTRIBENUM
sidhistory DYN_DECODE_SID
supportedcapabilities DYN_DECODE_ATTRIBENUM
supportedcontrol DYN_DECODE_ATTRIBENUM
supportedextension DYN_DECODE_ATTRIBENUM
systemflags DYN_DECODE_ATTRIBENUM
tokengroups DYN_DECODE_SID
tokenGroupsGlobalAndUniversal DYN_DECODE_SID
tokenGroupsNoGCAcceptable DYN_DECODE_SID
trustattributes DYN_DECODE_ATTRIBENUM
trustdirection DYN_DECODE_ATTRIBENUM
trusttype DYN_DECODE_ATTRIBENUM
useraccountcontrol DYN_DECODE_ATTRIBENUM
userCertificate DYN_DECODE_CERT
userparameters DYN_DECODE_BINARY
userSMIMECertificate DYN_DECODE_CERT
validaccesses DYN_DECODE_ATTRIBENUM
WhenChanged DYN_DECODE_GTFTIME
Whencreated DYN_DECODE_GTFTIME

Dynamic & Sort Attributes Options

The Dynamic and Sort Attributes options controls how attributes are decoded and sorted in the LDAP Search table view. 

When the Dynamic Attributes option is selected, before the user query is run, NetTools will query the Schema for all attributes that have the following attributes:

  • Any attributes that have Attribute Syntax of 2.5.5.12 (Sec-Desc) and will set the decode type to DYN_DECODE_SD for these attributes
  • Any attributes that have an Attribute Syntax of 2.5.5.17 (SID) and will set the decode type to DYN_DECODE_SID for these attributes 
  • Any attributes that have an Attribute Syntax of 2.5.5.11 (Generalized Date) and will set the decode type to DYN_DECODE_GTFTIME for these attributes
  • Any attributes that have an Attribute Syntax of 2.5.5.10 (Octet) and a fixed length of 16 and the name contains GUID and will set the decode type to DYN_DECODE_GUID for these attributes

If the Sort Attributes option is also enabled the following additional decode type will be set, this is to support the correct sorting of attribute data in the table view.

  • Any attributes that have Attribute Syntax of 2.5.5.16 (Large-integer) will be set to a decode type of DYN_DECODE_LARGEINT
  • Any attributes that have Attribute Syntax of 2.5.5.9 (Integer) will be set to a decode type of DYN_DECODE_INT

Attributes are have their DecodeType set by this process are shown in the Define Decode dialog with a type as Dynamic.

With both options selected is does result in more data being downloaded from the server, if the server is at the end of a slow link, deselecting these options will increase the speed, but at the cost of functionality.