root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to cheatsheets
root@sparrow:~/writeups$ cat ldapsearch.md
// Active Directory

ldapsearch

21 Jul 2026 · 5 min read
Active Directorycheatsheetsldapsearch
ldapsearch is OpenLDAP's command-line client for firing LDAP queries against a directory. In Active Directory pentesting it is the swiss army knife for enumerating the domain: users, groups, computers, policies and attributes, whether anonymously or authenticated.

The power of ldapsearch is not in the tool but in the LDAP filter you feed it: every query is an RFC 4515 filter over the domain tree. Mastering matching rules like 1.2.840.113556.1.4.803 (bitwise AND over userAccountControl) is what turns an innocent enumeration into the precise location of Kerberoastable accounts, accounts with delegation or without pre-authentication.

1. Beginner level — directory enumeration

LDAPSEARCH cheat sheet — Beginner
CommandWhat it does
ldapsearch -x -H ldap://<ip> -b 'DC=dom,DC=local'Anonymous query of the tree
ldapsearch -x -H ldap://<ip> -s base namingcontextsDiscover the naming contexts
ldapsearch -x -H ldap://<ip> -D 'user@dom' -w pass -b 'DC=dom,DC=local'Authenticated query
ldapsearch ... '(objectClass=user)'List all users
ldapsearch ... '(objectClass=group)'List all groups
ldapsearch ... '(objectClass=computer)'List the domain computers
ldapsearch ... '(objectClass=user)' sAMAccountNameReturn a single attribute only
ldapsearch -x ... -LLLClean output (no LDIF comments)
ldapsearch ... '(sAMAccountName=jdoe)'Filter by a specific user
ldapsearch -x -H ldap://<ip> -W -D 'user@dom' -b '...'Prompt for the password interactively
ldapsearch ... -s subSearch scope: full subtree
ldapsearch ... '(memberOf=CN=Domain Admins,...)'Members of Domain Admins
ldapsearch -x -H ldaps://<ip> ...Query over LDAPS (636)
ldapsearch ... > dump.ldifSave the dump to an LDIF

2. Advanced level — offensive AD queries

LDAPSEARCH cheat sheet — Advanced
CommandWhat it does
ldapsearch ... '(userAccountControl:1.2.840.113556.1.4.803:=4194304)'AS-REP-roastable accounts (no preauth)
ldapsearch ... '(servicePrincipalName=*)' servicePrincipalNameAccounts with an SPN (Kerberoasting)
ldapsearch ... '(userAccountControl:...:=524288)'Accounts with unconstrained delegation
ldapsearch ... '(objectClass=user)' descriptionHunt for passwords in descriptions
ldapsearch ... '(adminCount=1)'Protected accounts (AdminSDHolder)
ldapsearch ... ms-MCS-AdmPwdRead LAPS passwords (if you have permission)
ldapsearch ... '(&(objectClass=user)(!(userAccountControl:...:=2)))'Enabled accounts only
ldapsearch ... '(objectClass=trustedDomain)'Enumerate trust relationships
ldapsearch -E pr=1000/noprompt ...Paging for large domains
ldapsearch ... pwdLastSet lastLogonExtract account timestamps
ldapsearch ... '(objectClass=groupPolicyContainer)'Enumerate GPOs
ldapsearch ... nTSecurityDescriptor -o ldif-wrap=noDump ACLs without wrapping lines
ldapsearch -Y GSSAPI -H ldap://dc.dom ...Kerberos authentication (GSSAPI)
ldapsearch ... | grep -i memberofFilter group memberships

3. Details people miss

  • Many DCs block anonymous binds: if -x without credentials returns an Operations error or empty results, you need a valid domain account with -D and -w/-W.
  • Avoid -w pass on the command line: the password ends up in your shell history and in ps. Use -W so it prompts you interactively.
  • Active Directory caps responses at 1000 objects by default (MaxPageSize); on large domains use paging with -E pr=1000/noprompt or you will silently lose results.
  • Timestamps like pwdLastSet and lastLogon come as Windows FILETIME (100 ns since 1601), not Unix time: convert them before interpreting.
  • For Kerberos authentication with -Y GSSAPI you need a valid ticket (kinit) and must resolve the DC by name, not by IP, or the SASL exchange will fail.

Responsible use

These commands are for systems you own or have explicit written authorisation to test (labs, CTFs, contracted engagements). Using them against third-party infrastructure without permission is illegal in most countries.