Active Directory Query for "Non-Disabled Computers"& Expanded Query by Partial Computer Name *lt*

Posted on 2009-04-29
Last Modified: 2012-05-06
I need to adjust my LDAP query so that I get only computers that are not disabled.

The query I use to return only disabled workstations is (&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=2))

I need the exact same query, but in reverse so I get only the "non-disabled" workstations.

I also need to expand the query so that I can specify a partial computer name and get all the non-disabled computers that have the partial name *lt*
Question by:ACECORP
    1 Comment
    LVL 57

    Accepted Solution

    Some comments,
    This is not going to be an efficient query.  First because the ! is used (not).  Generally it is best to avoid those and the *text* string is also not efficient
    • Avoid using the logical NOT operator
      Avoid using the logical NOT operator because the query processor returns objects that you do not have access to or specific attributes that do not have a value. The query processor considers those objects and attributes as satisfying the query.  

    • Do not perform medial searches on attributes without medial indices
      Place wildcards at the end of, rather than at the beginning of, the search string. For example, use cn=smi* instead of cn=*hill* or cn=*mith. The standard indexes that were introduced with Windows 2000 are only useful for substring or exact match queries. If you want to perform medial searches, then you need to create a medial index on the attribute that will be part of a filter. The creation of a medial index is described later in this document.
    If you are only using this query once or twice you won't kill the performance of AD but if you are going to use it in some applications and doing it on a massive scale then you could run into issues.  You can also enable certain logging levels to help you identify those.  For more on field engineering logging see the recommendation here:

    Featured Post

    Highfive + Dolby Voice = No More Audio Complaints!

    Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

    Join & Write a Comment

    I'm sure that every Windows systems administrator has written, or at least used, a batch or VBS login script at some point in their career, whether it is to map network drives, install printers, or set some user preferences.  No more! With Window…
    Companies that have implemented Microsoft’s Active Directory need to ensure that the Active Directory is configured and operating properly. If there are issues found and not resolved, it eventually leads the components to fail or stop working and fi…
    This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
    This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…

    728 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    22 Experts available now in Live!

    Get 1:1 Help Now