Ldap

Performs LDAP operations

Synopsis

Ldap <subcommand>

Subcommands

For help on a subcommand, use Ldap <subcommand> -h

Ldap add

Adds an object to the directory

Synopsis

Ldap add [options] -ObjectClass <String> -ObjectName <String[]> <ServerName> <ObjectName> <ObjectClass>

Parameters

Options

Authentication

Authentication (Kerberos)

Authentication (NTLM)

Connection

Output

Ldap addcomputer

Adds a computer account to the directory

Synopsis

Ldap addcomputer [options] -ObjectName <String[]> <ServerName> <ObjectName>

Parameters

Options

Authentication

Authentication (Kerberos)

Authentication (NTLM)

Connection

Output

Ldap addou

Adds a new organizational unit

Synopsis

Ldap addou [options] -ObjectName <String[]> <ServerName> <ObjectName>

Parameters

Options

Authentication

Authentication (Kerberos)

Authentication (NTLM)

Connection

Output

Ldap adduser

Adds a new user

Synopsis

Ldap adduser [options] -ObjectName <String[]> <ServerName> <ObjectName>

Parameters

Options

Authentication

Authentication (Kerberos)

Authentication (NTLM)

Connection

Output

Ldap listsyntax

Lists AD syntaxes

Synopsis

Ldap listsyntax [options]

Options

Output

Details

A syntax describes the format of data within an attribute value and specifies how the raw bytes are decoded into the logical value.

Ldap lspart

Gets a list of partitions in the Active Directory forest

Synopsis

Ldap lspart [options] <ServerName>

Parameters

Options

Authentication

Authentication (Kerberos)

Authentication (NTLM)

Connection

Output

Details

This command queries all crossRef objects in the CN=Partitions container within the configuration NC.

Examples

Example 1 - List all partitions

Ldap lspart LUMON-DC1 -UserName marks@LUMON -Password She's@live!! -Kdc LUMON-DC1

Ldap mod

Modifies an object in the directory

Synopsis

Ldap mod [options] -ObjectName <String[]> <ServerName> <ObjectName> [ <Changes> ]

Parameters

Options

Authentication

Authentication (Kerberos)

Authentication (NTLM)

Connection

Output

Examples

Example 1 - Add a certificate to an account

Ldap mod LUMON-DC1 -UserName milchick@LUMON -Password Br3@kr00m! ALLENTOWN$  userCertificate:file+=allentown.cer

This command authenticates as milchick, loads the certificate from the file allentown.cer, and associates it with the ALLENTOWN$ account.

Example 2 - Adding resource-based constrained delegate to a computer account

Ldap mod LUMON-DC1 -UserName milchick@LUMON -Password Br3@kr00m!  Stealth$ msDS-AllowedToDelegateTo+=HOST/ALLENTOWN, msDS-AllowedToDelegateTo+=cifs/ALLENTOWN

This command authenticates as milchick and allows the STEALTH$ account to delegate to ALLENTOWN for the cifs and host SPNs.

Ldap moduser

Modifies a directory entry

Synopsis

Ldap moduser [options] -ObjectName <String[]> <ServerName> <ObjectName> [ <Changes> ]

Parameters

Options

Authentication

Authentication (Kerberos)

Authentication (NTLM)

Connection

Output

Details

Specify attribute changes as a series of name?=value pairs where ?= is:

+=   Add a value
-=   Remove a value
=    Replace all values

For example:

To add or remove multiple values, specify each value as a separate name?=value pair:

servicePrincipleName+=RestrictedKrbHost/ALLENTOWN

By default, the attribute values are parsed according to their syntax. For numeric attributes with bitflags, you may use the named bits, separating multiple bit names with a comma. For example, to set the encryption types for an account:

Use the namedbits command to view a list of supported attributes with bitflags.

You may specify multiple operations for the same attribute within a single command line. Each operation is sent to the LDAP server as part of the modification request, in the order specified on the command line. Note that consecutive changes to the same attribute with the same operation are combined. IN the above example, all 3 SPNs are added in a single operation.

Ldap mountfs

Mounts a directory as a file system

Synopsis

Ldap mountfs [options] <ServerName> [ <Mountpoint> ]

Parameters

Options

Authentication

Authentication (Kerberos)

Authentication (NTLM)

Connection

Output

Ldap namedbits

Prints the bits with symbolic names

Synopsis

Ldap namedbits [options] [ <Attribute> ]

Parameters

Options

Output

Ldap query

Queries the directory

Synopsis

Ldap query [options] <ServerName> [ <Filter> ]

Parameters

Options

Authentication

Authentication (Kerberos)

Authentication (NTLM)

Connection

Output

Details

Ldap query issues a query to an LDAP server. Use -OutputFields to specify the names of the attributes to retrieve; by default, only the DN of the entries is printed.

If no search base is provided, Ldap query uses the root of the domain.

-SearchBase supports these special names:

• DomainRoot - the default domain naming context of the server
• ForestRoot - the forest root naming context
• ConfigRoot - the configuration naming context
• SchemaRoot - the schema naming context
• RootDse - The root entry

-Filter accepts an LDAP query. An LDAP query consists of one or more assertions of the form

where <op> is one of: = (exact match, has attribute, or matches substring) ~= (approximate match) <= (less or equal) >= (greater or equal) &= (has all bits) (LDAP_MATCHING_RULE_BIT_AND) |= (has one or more bits) (LDAP_MATCHING_RULE_BIT_OR) *= (transitive match) (LDAP_MATCHING_RULE_TRANSITIVE_EVAL)

NOTE: Active Directory treats = and ~= the same, although the queries are represented differently on the wire. NOTE: &=, |=, and *= are extensions implemented by Active Directory.

To invert a filter and return objects that do not meet the criteria, prepend a !. For example, to return disabled accounts:

To query objects with an attribute, use =*. For example, to query objects with a servicePrincipalName, use:

(servicePrincipalName=*)

To combine multiple assertions, specify a & (all must match) or | (at least one must match) followed by multiple filter clauses, surrounding the entire expression with ( and ). For example:

(&(attr1=value)(attr2=value)(attr3=value))

A few of the fields support named bits. Use the namedbits command for a list of supported attributes and bit names.

NOTE: Although not strictly required, it is a good idea to surround the filter with quotes to avoid having to escape special characters.

Examples

Example 1 - Find User with Logon Name ‘milchick’

Ldap query LUMON-DC1 '(samAccountName=milchick)' -OutputFields distinguishedName, objectSid

Example 2 - Find Objects with SPNs

Ldap query LUMON-DC1 '(servicePrincipalName=*)' -OutputFields distinguishedName, objectSid, servicePrincipalName

Example 3 - Query rootDse with no authentication

Ldap query LUMON-DC1 -OutputFields * -OutputStyle List

Example 4 - Query for accounts trusted for unconstrained delegation

Ldap query LUMON-DC1 -OutputFields * "(userAccountControl|=TrustedForDelegation)"

Example 5 - Query for accounts trusted for S4U2self

Ldap query LUMON-DC1 -OutputFields * "(userAccountControl|=TrustedForS4U2self)"

Example 6 - Query for accounts trusted for constrained delegation

Ldap query LUMON-DC1 -OutputFields * "(msDS-AllowedToDelegateTo=*)"

Ldap rm

Deletes an object from the directory

Synopsis

Ldap rm [options] -ObjectName <String[]> <ServerName> <ObjectName>

Parameters

Options

Authentication

Authentication (Kerberos)

Authentication (NTLM)

Connection

Output

Ldap schema

Gets the schema

Synopsis

Ldap schema [options] <ServerName>

Parameters

Options

Authentication

Authentication (Kerberos)

Authentication (NTLM)

Connection

Output

Ldap search

Searches the directory by name

Synopsis

Ldap search [options] -SearchName <String[]> <ServerName> <SearchName>

Parameters

Options

Authentication

Authentication (Kerberos)

Authentication (NTLM)

Connection

Output

Details

Ldap search uses the ANR feature of Active Directory to find objects where any designated name-like field begins with a search string.

To request items that match exactly (rather than those beginning with) a search term, prepend = to the search term.

Other substring searches (contains or begins with) are not supported; wildcards will be interpreted literally.

Note that these rules are observed and enforced by Active Directory; Ldap search merely sends what you give it.

Examples

Example 1 - Search for accounts beginning with admin

Ldap search admin

Example 2 - Search for accounts matching milchick exactly

Ldap search =milchick

Example 3 - Search using SSL (Kerberos)

Ldap search LUMON-DC1 -UserName marks@LUMON -Password She's@live!! -Kdc LUMON-DC1 -Ssl milchick

Example 4 - Search using SSL (NTLM)

Ldap search LUMON-DC1 -UserName marks@LUMON -Password She's@live!! -Ssl milchick

Ldap timestamp

Converts between the Active Directory timestamp value and a UTC date/time

Synopsis

Ldap timestamp [options] [ <TimestampOrDate> ]

Parameters

Options

Output

Details

If the input is a number, it is converted to a date. The number may include the thousands separator, since the Active Directory is likely printed this way. The result is of the form 2026-03-17T17:38:42.2091265Z, which preserves the precision of the timestamp value.

If the input is a date, it is converted to a timestamp value, with the thousands separator. The date may be in any parsable format, such as 2026-03-17T17:38:42.2091265Z or 3/17/2026 5:38:42 PM, depending on your local culture settings. Note that some formats preserve more precision that others, and the resulting timestamp value reflects this.

You may specify multiple values. Each output record prints both the numeric value and the date/time so you know which record matches which input.

Examples

Example 1 - Convert a timestamp from AD

134,182,427,222,091,265

The value is converted to 2026-03-17T17:38:42.2091265Z

Example 2 -

"3/17/2026 5:38:42 PM"

The value is converted to 134,182,427,220,000,000. Dates of this format lack the precision of an Active Directory timestamp so the last several digits are 0.

Example 3 -

2026-03-17T17:38:42.2091265Z

The value is converted to 134,182,427,222,091,265

Example 4 - Multiple values

2026-03-17T17:38:42.2091265Z 134,182,427,220,000,000

Prints two records corresponding to the two inputs

Ldap watch

Watches for changes to an object or subtree

Synopsis

Ldap watch [options] <ServerName>

Parameters

Options

Authentication

Authentication (Kerberos)

Authentication (NTLM)

Connection

Output

Ldap whoami

Gets the name of the authenticated user

Synopsis

Ldap whoami [options] <ServerName>

Parameters

Options

Authentication

Authentication (Kerberos)

Authentication (NTLM)

Connection

Output