---
title: "Master your LDAP Filters in PowerShell while Learning AD"
description: "Learning how to use LDAP filter, how to filter with the Active Directory PowerShell cmdlets, and learn the right way to filter AD objects."
canonical: "https://adamtheautomator.com/ldap-filter/"
---

# Master your LDAP Filters in PowerShell while Learning AD

> Learning how to use LDAP filter, how to filter with the Active Directory PowerShell cmdlets, and learn the right way to filter AD objects.

Source: https://adamtheautomator.com/ldap-filter/

---

ATA Learning

Tap to hide

[

ATA Learning

](/)

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Search for:  

*   [](https://twitter.com/adbertram)
*   [](https://github.com/Adam-the-Automator)
*   [](https://www.linkedin.com/company/adam-the-automator-llc)
*   [](/feed/)

![Master your LDAP Filters in PowerShell while Learning AD](https://adamtheautomator.com/wp-content/uploads/2019/08/darknet-3588402_1280.jpg)

# Master your LDAP Filters in PowerShell while Learning AD

[![](https://secure.gravatar.com/avatar/995fcc2faf7fc9d3f15061d8e6c5b84f4b751d96502ef7afb4f9f648a58b36a4?s=192&d=mm&r=g)Stuart Squibb](https://adamtheautomator.com/author/stuart/)26 November 20214 min. read

Categories: [IT Ops](/category/it-ops/)

Tags:[Active Directory](/tag/active-directory/)[PowerShell](/tag/powershell/)

Table of Contents

*   [Prerequisites](#prerequisites)
*   [PowerShell Filters](#powershell-filters)
*   [Operators](#operators)
*   [Reference AD Object Properties](#reference-ad-object-properties)
*   [What is Active Directory LDAP?](#h-what-is-active-directory-ldap)
*   [LDAP Filters](#ldap-filters)
*   [LDAP Filter Examples](#ldap-filter-examples)
*   [Using RecursiveMatch or Chain Matching](#using-recursivematch-or-chain-matching)
*   [The SearchBase and SearchScope Parameters](#the-searchbase-and-searchscope-parameters)
*   [Summary](#summary)
*   [Further Reading](#further-reading)

One of the most common hangups when querying Active Directory with PowerShell is how to properly build filter syntax. The `Filter` and LDAP Filter parameters on all ActiveDirectory PowerShell module cmdlets is a black box to many.

In this blog post, we’re going to dive deep into understanding how to use Active Directory filters. I hope by the end of this post, you’ll no longer be attempted to use that `Where-Object` and [filter right](https://mcpmag.com/articles/2018/01/16/filtering-command-output-in-powershell.aspx)!

## Prerequisites

For any of the code I’m about to show you to work, I’ll be assuming a few things:

*   you have the [PowerShell ActiveDirectory module installed](https://adamtheautomator.com/powershell-import-active-directory/)
*   you’re on a domain-joined computer
*   you can successfully [connect and authenticate to an AD domain controller](https://adamtheautomator.com/powershell-import-active-directory/)

There are two different filter languages you can use when searching for objects using many of the Active Directory cmdlets: PowerShell filters and LDAP filters.

## PowerShell Filters

PowerShell filters use the standard PowerShell expression syntax. This is commonly referred to as Active Directory search filter syntax.

These filters are used with the the `Filter` parameter. The `Filter` parameter syntax

### Operators

While building a filter for the `Filter` parameter, you’ll need to use at least one operator. The operators used here are the familiar operators you may be used to when using commands like [`Where-Object`](https://adamtheautomator.com/powershell-where-object/ "Where-Object").

Inside of the `Filter` parameter, you can use the following operators.

| Operator | Explanation |
| --- | --- |
| \-eq | Equal to |
| \-le | Less than or equal to |
| \-ge | Greater than or equal to |
| \-ne | Not equal to |
| \-lt | Less than |
| \-gt | Greater than |
| \-approx | Approximately equal to |
| \-bor | Bitwise OR |
| \-band | Bitwise AND |
| \-recursivematch | Recursive match |
| \-like | Like |
| \-notlike | Not like |
| \-and | Boolean AND |
| \-or | Boolean OR |
| \-not | Boolean NOT |

### Reference AD Object Properties

Inside of the filter, you will compare various AD object properties using operators. For example, the [`Get-AdUser`](https://adamtheautomator.com/get-aduser/ "Get-AdUser") cmdlet returns a `Name` property. If you’d like to find all users matching a specific name, you’d use:

```powershell
PS51> Get-Aduser -Filter "Name -eq 'Adam Bertram'"
```

Property names can be the name or LDAP filter name of the property returned with the AD cmdlet.

Property values are normally wrapped in single or double quotes. The only wildcard accepted is the asterisk (_\*_). You can see above that the filter is surrounded by double quotes yet _Adam Bertram_ is surrounded with single quotes.

Certain characters must be ‘escaped’ when used in filters. These are:

| Character | Escaped As | Notes |
| --- | --- | --- |
| “ | \`” | Only required if the data is enclosed in double quotes. |
| ‘ | \\’ | Only required if the data is enclosed in single quotes. |
| NUL | \\00 | This is a standard LDAP escape sequence. |
| \\ | \\5c | This is a standard LDAP escape sequence. |
| \* | \\2a | Automatically escaped. Only in -eq and -ne comparisons. You should use -like and -notlike operators for wildcard comparison. |
| ( | /28 | Automatically escaped. |
| ) | /29 | Automatically escaped. |
| / | /2f | Automatically escaped. |

## What is Active Directory LDAP?

LDAP, or Lightweight Directory Access Protocol, is a vendor-neutral protocol for accessing and modifying directory data. You may think of a phonebook when hearing the word directory, but in the context of Active Directory, this means so much more. Many different object types are stored and made accessible by Active Directory with the LDAP protocol functioning as a means to access that data.

As Active Directory can store many different data types, applications and users need a way to query that directory easily. Read on to learn how LDAP Filters assist in filtering that data!

## LDAP Filters

Active Directory implements LDAP, the _Lightweight Directory Access Protocol_. Using the `LDAPFilter` parameter with the cmdlets allows you to use LDAP filters, such as those created in _Active Directory Users and Computers_.

The syntax for LDAP filters is defined in [RFC number 4515](https://tools.ietf.org/html/rfc4515) .

Each filter rule is surrounded by parentheses `( )`. Filter rules can be grouped by surrounding the group in parentheses and including a comparator from the following:

| Operator | Function |
| --- | --- |
| & | and |
| | | or |
| ! | not |

LDAP filters also have a special matching rule _Object IDentifiers_ (OIDs):

| OID | Purpose |
| --- | --- |
| 1.2.840.113556.1.4.803 | Bitwise AND |
| 1.2.840.113556.1.4.804 | Bitwise OR |
| 1.2.840.113556.1.4.1941 | Chain matching (for distinguished name attributes) |

There are four filter types:

| Operator | Explanation |
| --- | --- |
| \= | Equal to |
| ~= | Approximately equal to |
| \>= | Greater than or equal to |
| <= | Less than or equal to |

There are four item types:

| Type | Explanation |
| --- | --- |
| \= | Simple |
| \=\* | Present |
| \=something\* | Substring |
| Extensible | varies depending on type |

The LDAP filter rules must be used with the LDAP names of attributes, and certain character values must be ‘escaped’ if used in an [LDAP filter](https://adamtheautomator.com/ldap-filter/). These are:

| Character | Escaped As |
| --- | --- |
| \* | \\2a |
| ( | \\28 |
| ) | \\29 |
| \\ | \\5c |
| NUL | \\00 |

Property values for comparison do not normally need to be wrapped in quotes.

### LDAP Filter Examples

Building LDAP filters can be challenging. Here are some examples using active directory group filters you can use as a base to begin creating your own.

*   All groups with a name (cn) of ‘Professional Services Department’
    
    `'cn -eq "Professional Services Department"'` or \``'(cn=Professional Services Department)'`
    
*   All groups with a name of ‘Professional Services Department’ and a description of ‘Live’
    
    `'(cn -eq "Professional Services Department") -and (description -eq "Live")'` or `'(&(cn=Professional Services Department)(description=Live))'`
    
*   All groups with a name of either ‘Professional Services Department’ or ‘All Departments Share Access’
    
    `'(cn -eq "Professional Services Department") -or (cn -eq "All Departments Share Access")'` or `'(|(cn=Professional Services Department)(cn=All Departments Share Access))'`
    
*   All groups not having a description of ‘Live’. _Includes_ those with no description field at all
    
    `'(!(description=Live))'`
    
*   All groups not having a description of ‘Live’. _Excludes_ those with no description field at all
    
    `'description -ne "Live"'`
    
*   All groups with a description of ‘Live’ but not with a name of ‘Professional Services Department’
    
    `'(description -eq "Live") -and (cn -ne "Professional Services Department")'` or `'(&(description=Live)(!(cn=Professional Services Department)))'`
    
*   All groups whose description is ‘\\\\fileserver1\\fileshare’
    
    `'description -eq "\5c\5cfileserver1\5cfileshare"'` or `'(description=\5c\5cfileserver1\5cfileshare)'`
    

### Using RecursiveMatch or Chain Matching

Using a matching rule OID, or the `RecursiveMatch` parameter is a powerful way of solving a question often asked about querying AD: _‘How can I tell all of the groups a user is a member of, both directly and indirectly?’_ You use the Active Directory Search Filter `memberOf` property to find out.

Using a simple LDAP matching rule can be far more efficient than a large script. Using our example domain _domain.local_, Kristin Diaz is a direct member of the _Professional Services Department_ security group. Looking at her `memberOf` property in AD reflects this; only _Professional Services Department_ is shown.

```powershell
PS51> Get-ADUser -Identity Kristin.Diaz -Property memberOf

DistinguishedName : CN=Diaz Kristin,OU=Professional Services,OU=All User Accounts,DC=domain,DC=local
Enabled           : True
GivenName         : Kristin
MemberOf          : {CN=Professional Services Department,OU=All Groups,DC=domain,DC=local}
Name              : Diaz Kristin
ObjectClass       : user
ObjectGUID        : 04fe6336-c541-4e71-b7ed-6fee7db23482
SamAccountName    : Kristin.Diaz
SID               : S-1-5-21-447422785-3715515833-3878445295-1186
Surname           : Diaz
UserPrincipalName :
```

By using the matching rule OID, or `RecursiveMatch` parameter you will find that they are indirectly a member of _All Departments Share Access_. This is because the _Professional Services Department_ group is a member of _All Departments Share Access_.

```powershell
PS51> Get-ADGroup -LDAPFilter '(member:1.2.840.113556.1.4.1941:=CN=Diaz Kristin,OU=Professional Services,OU=All User Accounts,DC=domain,DC=local)'
```

```powershell
PS51> Get-ADGroup -Filter 'member -RecursiveMatch "CN=Diaz Kristin,OU=Professional Services,OU=All User Accounts,DC=domain,DC=local"'
```

Both return the following:

```powershell
DistinguishedName : CN=All Departments Share Access,OU=All Groups,DC=domain,DC=local
GroupCategory     : Security
GroupScope        : Universal
Name              : All Departments Share Access
ObjectClass       : group
ObjectGUID        : 8ac0e0b7-9225-40a4-b168-a0330960e182
SamAccountName    : All Departments Share Access
SID               : S-1-5-21-447422785-3715515833-3878445295-1254

DistinguishedName : CN=Professional Services Department,OU=All Groups,DC=domain,DC=local
GroupCategory     : Security
GroupScope        : Universal
Name              : Professional Services Department
ObjectClass       : group
ObjectGUID        : a8432583-7cac-4e8e-8d94-51e1c5bb1989
SamAccountName    : Professional Services Department
SID               : S-1-5-21-447422785-3715515833-3878445295-1255
```

## The SearchBase and SearchScope Parameters

In large environments, AD can contain many thousands of objects. A way of improving performance and reducing the number of objects returned for any query is to scope the search.

The `SearchBase` parameter determines where in the AD hierarchy any search begins. When using the cmdlets this is a string representation of a distinguished name (and by default is the ‘top’ of the domain). There are also three levels of `SearchScope`:

1.  **Base** – The object that has been specified as the SearchBase.
2.  **OneLevel** – searches for objects immediately contained by the SearchBase but not in any sub containers.
3.  **SubTree** – searches for objects contained by the SearchBase and in any subcontainers, recursively down through the AD hierarchy.

![Carisbrookelabs.local OU Structure](/wp-content/uploads/2019/08/OUStructure.png)

Example OU Structure

In the above example, with the SearchBase set to _OU=All User Accounts,DC=domain,DC=local_, a `SearchScope` of `Base` would try to query the OU object itself, a `SearchScope` of `OneLevel` would search the _All User Accounts_ OU only, and a `SearchScope` of `SubTree` would search both the _All User Accounts_ and _Professional Services_ OUs.

## Summary

You should now have a good understanding of how to filter with the Active Directory PowerShell cmdlets. You can see there’s a lot to crafting that perfect filter syntax. It’s a lot harder building the appropriate filter than using the `Where-Object` cmdlet.

But spend the time learning the ‘right’ way to filter AD objects and reap the rewards of great performance and efficiency!

## Further Reading

*   **_[32 Active Directory Scripts to Automate Anything](https://adamtheautomator.com/active-directory-scripts/)_**
*   [**_LDAP Syntax Filters on TechNet_**](https://social.technet.microsoft.com/wiki/contents/articles/5392.active-directory-ldap-syntax-filters.aspx)

Share this article

[Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fldap-filter%2F&text=Master%20your%20LDAP%20Filters%20in%20PowerShell%20while%20Learning%20AD)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fldap-filter%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fldap-filter%2F)

## Related Posts

![](https://adamtheautomator.com/wp-content/uploads/2024/11/image-23.png)

### [Managing Active Directory Groups with PowerShell: The Ultimate Guide](/powershell-ad-groups-guide/)

Learn how to manage Active Directory groups with PowerShell! This hands-on guide shows you how to query, create and modify AD groups using practical real-world

![](https://adamtheautomator.com/wp-content/uploads/2019/08/database-152091_1280.png)

### [Active Directory Database: PowerShell Monitoring Made Easy](/active-directory-database/)

Find the ntds.dit location and monitor your Active Directory database using PowerShell.

![](https://adamtheautomator.com/wp-content/uploads/2019/07/panic-1393619_1280.png)

### [How to Find Locked Out Users in Active Directory with PowerShell](/find-locked-out-users-in-active-directory-powershell/)

See what we can do to find locked out users in Active Directory with PowerShell!

## Categories

*   [IT Ops](/category/it-ops/)
*   [Cloud](/category/cloud/)
*   [DevOps](/category/devops/)
*   [Home Ops](/category/home-ops/)
*   [Information Security](/category/infosec/)
*   [Software Development](/category/software-development/)

## Site

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)