LDAP Query that exclude computers

Question

I had never done any DAP/AD admin or querying. Right now I have a task where I need to get all the USERS in our company's AD; but keep getting computers in the query's result. I use objectClass=user and still get all the computers in the AD. What else am I missing? Is there a way to say "objectClass=user and not objectClass=Computer"? thanks!

Solution

Try this filter: (&(objectClass=user)(!(objectClass=computer)))

Comments

[zagyi]

Well, the LDAP syntax is not exactly human friendly. :) It's handy to have a tool that helps writing filters. I use Apache Directory Studio which is quite nice.

[Luis Garcia]

No kidding! I write SQL queries often so was familiar with the logic; but the syntax was very interesting to say the least. Thanks for the tip on the Apache tool, very helpful!

[Kirill G.]

@zagyi any ideas why (&(objectClass=person)(!(objectClass=computer))) does not return any results on OpenLdap? Btw, (&(objectClass=person)) does returns existing users, and (&(objectClass=computer)) does not return any values (which means I do not have any persons who are also computers.

[lara400]

Doesn't matter if your in 2019 or any year - the question was about using LDAP and your answer is using Powershell AD module that is not relevant to the question at hand. The original answer is still valid and applies.