Return all users except built-in

How can I return a list of AD users, omitting the built-in users?

Richard
Fri Jan 26 12:11:34 CST 2007

Epoh Rio wrote:

> How can I return a list of AD users, omitting the built-in users?
>

You probably mean users like Administrator and Guest. There is no way to
query for users except these. You can't even query for all users except
those in the cn=Users container.

If all non built-in users are in one OU and it's children, you can use this
OU as the base of the query. Otherwise, you could place all built-in users
in a group and query for all users that are not members of that group. For
example, create a group called Builtin in the cn=Users container. Make
Administrator, Guest, IUSR_server, IWAM_server, krbtgt members of this
group. Then to query for all other users:

(&(objectCategory=person)(objectClass=user)(!memberOf=cn=Builtin,cn=Users,dc
=MyDomain,dc=com))

where "!" is the NOT operator. You must specify the full Distinguished Name
of the group members to exclude. Note you cannot exclude the container or OU
the object resides in.

--
Richard
Microsoft MVP Scripting and ADSI
Hilltop Lab web site - http://www.rlmueller.net
--

Epoh
Mon Feb 05 11:45:17 CST 2007

I see, a while back I saw that someone posted an identitical question
to mine. And someone made the suggestion to look for all users where
givenName and sn were not null. As a rule, a built-in object does not
contain a first or last name unless it has been modified. I have
looked for that post several times since then and have not been able
to find it.

Richard
Mon Feb 05 12:07:09 CST 2007


"Epoh Rio" <epohxcvii@hotmail.com> wrote in message
news:1170697512.995783.206140@a34g2000cwb.googlegroups.com...
> I see, a while back I saw that someone posted an identitical question
> to mine. And someone made the suggestion to look for all users where
> givenName and sn were not null. As a rule, a built-in object does not
> contain a first or last name unless it has been modified. I have
> looked for that post several times since then and have not been able
> to find it.
>

If sn and/or givenName are always assigned in your environment, that could
work. You can use ADO to retrieve all user objects where these attributes
are not null with a filter similar to:

(&(objectCategory=person)(objectClass=user)(sn=*)(givenName=*))

The "*" is the wildcard character. The clause (sn=*) means sn has any value
except Missing. In the above I require that both sn and givenName have
non-Missing values. Does this help? For more on using ADO to search AD, see
this link:

http://www.rlmueller.net/ADOSearchTips.htm

--
Richard
Microsoft MVP Scripting and ADSI
Hilltop Lab web site - http://www.rlmueller.net
--