Ldap tool connects to an LDAP server (typically an Active Directory domain controller) and lets you search for objects by name, run raw LDAP filter queries, monitor directory changes in real time, inspect the schema, and create or modify users, computers, organizational units, and arbitrary objects.
Subcommands
| Command | Description |
|---|---|
| search | Search the directory by name using ANR |
| query | Run a raw LDAP filter query |
| watch | Watch for changes to an object or subtree |
| schema | Retrieve the directory schema |
| listsyntax | List all Active Directory attribute syntaxes |
| namedbits | Show named bit flags for bitfield attributes |
| add | Add an arbitrary object to the directory |
| addou | Add a new organizational unit |
| adduser | Add a new user account |
| addcomputer | Add a computer account |
| mod | Modify attributes on an existing object |
| moduser | Modify a user account (including password operations) |
| whoami | Display the identity of the authenticated user |
For help on any subcommand, run
Ldap <subcommand> -h.search
Searches the directory by name using Active Directory’s Ambiguous Name Resolution (ANR) feature. ANR matches any designated name-like field (display name, SAM account name, UPN, etc.) that begins with the search string.Parameters
Parameters
Search options
Search options
DN of the search root. Defaults to the domain root. Accepts special names:
DomainRoot, ForestRoot, ConfigRoot, SchemaRoot, RootDse.Scope of the search. Possible values:
BaseObject, Base, SingleLevel, WholeSubtree, Subtree.Number of results to fetch per page.
Maximum total number of records to return.
Include soft-deleted (tombstoned) objects.
Include deleted and recycled objects.
Follow LDAP referrals to other servers.
Authentication
Authentication
User name to authenticate with (not including the domain).
Domain of the authenticating user.
Password for authentication.
NTLM hash for pass-the-hash authentication.
AES key (128 or 256-bit) for Kerberos authentication.
Path to a ticket-granting ticket file (
.kirbi or ccache).KDC endpoint (
host:port).Use anonymous (unauthenticated) login.
Examples
query
Issues a raw LDAP filter query to the server. Use-OutputFields to specify which attributes to return; by default, only the DN of matching entries is printed.
Parameters
Parameters
Query options
Query options
LDAP filter. Supported operators:
=, ~=, <=, >=, &= (bit AND), |= (bit OR), *= (transitive match). Negate with !.DN of search root. Accepts special names:
DomainRoot, ForestRoot, ConfigRoot, SchemaRoot, RootDse.Search scope:
BaseObject, Base, SingleLevel, WholeSubtree, Subtree.Results per page.
Maximum total records to return.
Include tombstoned objects.
Include recycled objects.
Return only changes since the given DirSync cookie (hex-encoded).
Follow LDAP referrals.
LDAP filter syntax
Filters take the form(<attr> <op> <value>). Combine multiple filters with & (all must match) or | (at least one must match):
&=, |=, *=) are supported.
Examples
watch
Watches for changes to an object or subtree using the LDAP DirSync control. The command runs continuously and prints updates as they arrive.Parameters
Parameters
Name or address of the LDAP server.
Watch options
Watch options
DN of the subtree to watch. Defaults to the domain root.
Search scope:
BaseObject, Base, SingleLevel, WholeSubtree, Subtree.Resume watching from a previously saved DirSync cookie.
Specific attributes to include in the output.
schema
Retrieves schema information from the directory, including attribute definitions and object classes.Parameters
Parameters
Name or address of the LDAP server.
listsyntax
Lists all Active Directory attribute syntaxes. A syntax describes the format of an attribute’s data and how raw bytes are decoded into logical values.namedbits
Prints named bit flags for bitfield attributes. Use this to discover which bit names to pass when setting attributes likeuserAccountControl or msDS-SupportedEncryptionTypes.
Parameters
Parameters
One or more attribute names to print. Omit to print all known bitfield attributes.
Output options
Output options
Fields to display. Possible values:
EqualityContract, Attribute, Name, Value, HexValue.add
Adds an arbitrary object of a specified object class to the directory.Parameters
Parameters
Object options
Object options
Additional attributes to set at creation time, as
name=value pairs.addou
Adds a new organizational unit to the directory.Parameters
Parameters
OU options
OU options
Additional attributes to set, as
name=value pairs.adduser
Adds a new user account to the directory.Parameters
Parameters
User options
User options
Initial password for the new account.
SAM account name (pre-Windows 2000 logon name).
First name.
Last name.
Display name shown in directory listings.
Paths to certificate files to associate with the user.
Groups to add the user to at creation time.
Additional attributes as
name=value pairs.addcomputer
Adds a computer account to the directory.Parameters
Parameters
Computer options
Computer options
Password for the computer account.
SAM account name for the computer.
Display name for the account.
Name of the installed operating system.
Version of the installed operating system.
Paths to certificate files to associate with the account.
Groups to add the computer to.
Additional attributes as
name=value pairs.mod
Modifies one or more attributes on an existing directory object.Change syntax
Specify each change asname?=value where ?= is one of:
| Operator | Effect |
|---|---|
+= | Add a value |
-= | Remove a value |
= | Replace all values |
namedbits to list supported attributes and their bit names.
Examples
moduser
Modifies a user account, including password change and reset operations.Parameters
Parameters
whoami
Returns the identity of the currently authenticated user as seen by the LDAP server.Parameters
Parameters
Name or address of the LDAP server.
Output options
Output options
Fields to display. Possible values:
SaslString, PrincipalName, Kind.Common options
AllLdap subcommands that connect to a server accept these shared options.
SSL / TLS
SSL / TLS
| Option | Description |
|---|---|
-Ssl | Use SSL for the connection |
-SslCert | Path to a PEM or PFX certificate file |
-SslKeyFile | Path to a PFX file for SSL client authentication |
-SslKeyPassword | Password for -SslCert or -SslKeyFile |
Kerberos authentication
Kerberos authentication
| Option | Description |
|---|---|
-AesKey | AES-128 or AES-256 key |
-DesKey | DES key |
-Tgt | TGT file path (.kirbi or ccache) |
-Tickets | Service ticket file paths |
-TicketCache | Ticket cache file path |
-Kdc (-K) | KDC endpoint (host:port) |
-S4UserName | User to impersonate via S4U |
-UserCert | Certificate file for PKINIT |
-UserKey | Key file for PKINIT |
Connection
Connection
| Option | Description |
|---|---|
-HostAddress (-ha) | Override network address(es) of the server |
-UseTcp6Only (-6) | Force IPv6 |
-UseTcp4Only (-4) | Force IPv4 |
-Socks5 | SOCKS5 proxy endpoint |
-AuthProxy | Authentication proxy endpoint |
Output verbosity
Output verbosity
| Option | Description |
|---|---|
-Verbose (-V) | Print verbose messages |
-Diagnostic (-vv) | Print diagnostic messages |
-LogLevel | Minimum log level: Debug, Verbose, Info, Warning, Error, Critical |
-ConsoleLogFormat (-LogFormat) | Log format: Text, TextWithTimestamp, Json |
Related tools
Sddl
Parse and describe security descriptors that appear in LDAP attributes.
Cert
Create self-signed certificates to associate with directory accounts.