rootninja

Find computers and their description from the AD

dsquery * -filter “(&(objectClass=Computer)(objectCategory=Computer))” “%rootDN%” -attr cn description

Use LDP to search for tombstoned objects in AD

Base DN: CN=Deleted Objects,%domainRoot%, Filter: (isDeleted=*), Extended Search, Add control: 1.2.840.113556.1.4.417

Show all replicated attributes in the AD Schema

dsquery * cn=schema,cn=configuration,DC=forestRootDomain -filter “(&(objectClass=attributeSchema)(objectCategory=attributeSchema)(!systemFlags:1.2.840.113556.1.4.803:=1))” -limit 0

Show an AD schema attribute

dsquery * cn=pwd-last-set,cn=schema,cn=configuration,DC=forestRootDomain

Find a list of CNs in the directory and return their homeDirectory

for /f %i in (Users.txt) do @for /f “tokens=*” %m in (’”dsquery user -name %i”‘) do @for /f %p in (’”dsquery * %m -attr homeDirectory -l | find /i “\\” & if errorlevel 1 Echo NoHomeDirectory”‘) do @echo %i,%m,%p

Identify the DN of an Active Directory group

dsquery group -name %GroupName%

Find the current group scope of a security group

dsget group %GroupDN% -scope -secgrp

Find all user accounts with a UPN, and count the DNs returned

dsquery * domainroot -filter “&(objectclass=user)(objectcategory=person)(userprincipalname=*)” -s %server% | find /i /c “user”

Find all user accounts without a UPN, and count the DNs returned

dsquery * domainroot -filter “&(objectclass=user)(objectcategory=person)(!(userprincipalname=*))” -s %server% | find /i /c “user”

Determine whether an attribute is replicated in AD through bitwise AND

dsquery * cn=%AttributeName%,cn=schema,cn=configuration,dc=forestRootDomain -filter “!(&(systemFlags:1.2.840.113556.1.4.803:=1))”

Query for the display specifiers in the AD user class

dsquery * “CN=user-Display,CN=409,CN=DisplaySpecifiers,CN=Configuration,%forestrootDomain%” -attr *

Query a user from AD using WMI

wmic /node:”%DC%” /namespace:\\root\directory\LDAP path ds_user where “ds_cn=’%username%’” GET ds_displayName,DS_UserPrincipalName,ds_cn,ds_name,ds_whenCreated

Return the DN of a list of users

for /f %i in (%users.txt%) do @dsquery user -name %i

These were all useful to me. I found them, and more, here.