Using Saved Queries in ADUC MMC (Active Directory User and Computers)

The Saved Queries in Active Directory Users and Computers (ADUC) MMC console allow you to create complex LDAP filters to select Active Directory objects. These queries can be saved, edited, and copied to other computers. You can use the Active Directory saved queries to quickly and efficiently find AD objects based on various criteria. Saved Queries can help you quickly perform common AD object administration tasks: display the list of all disabled accounts in a domain, select all users of a company who have mailboxes on a given Exchange server, etc.

When using saved LDAP queries, the administrator can perform group operations with objects from different OUs (containers) of Active Directory. For example, you can perform bulk lock/unlock/enable/disable, move, delete, and rename operations under AD objects/accounts. Such queries in the ADUC console allow you to bypass the hierarchical structure of OUs in Active Directory and collect all the necessary objects in a flat table view.

Active Directory Saved Queries were first introduced in Windows Server 2003 and got further support in the later Windows Server versions. To use saved AD queries, you must have the ADUC console installed on your computer (is a part of RSAT administration tools).

How to Create a Saved Query in the Active Directory MMC Console

Let’s take a look at a few typical examples of using saved LDAP queries in the Active Directory Users and Computers console to search objects. Suppose, we have to display the list of active user accounts, their department names, and e-mail addresses.

1. Open the ADUC console (dsa.msc), right-click Saved Queries and select New – > Query;
2. In the Name box, specify the name of the saved query to be displayed in the ADUC console.
3. In the Query root field, you can specify the container (OU) in which you want to search. By default, the search by the query criteria is performed across the entire AD domain. In our example, we’ll narrow the search scope by selecting Brasil container;
4. Then click on the Define Query button, and select the Custom Search in Find drop-down list;
5. Go to Advanced tab and copy the following LDAP query into Enter LDAP query box. This query selects an enabled user account (see other examples of LDAP queries in the table below):
   (&(objectcategory=person)(objectclass=user)(!userAccountControl:1.2.840.113556.1.4.803:=2))
6. Save the changes by clicking OK;
7. Select the created query in ADUC console, press F5 to build the object list. As a result, a list of users will appear in the right window that matches your LDAP query;
8. To display the additional user attributes (e-mail address, department, etc.), open View menu in the ADUC console and select Add/Remove Columns;
9. Add the columns you want. We have added 3 additional fields: User Logon Name, E-Mail Address, Department;
10. The resulting list of user accounts can be saved to a CSV or TXT file for further analysis and import into Excel. To do it, right-click on the saved query and select the Export List menu item.
    Note. You can also get data from AD using PowerShell and save it directly to an Excel file.
    

In the ADUC console, you can create several different saved queries and organize them in a tree structure. In this way, you can create a convenient collection of LDAP queries to quickly perform common AD administration tasks.

The ADUC mmc snap-in supports several modes of building Active Directory saved queries. It is not necessary to manually specify the LDAP filter code each time. You can create your AD query with a simple graphical wizard. You simply select different attributes of AD objects and use them to search objects according to the criteria you want. For example, to list all Windows Server computer objects in a domain:

1. Find -> Computers;
2. Go to the Advanced tab ;
3. Fields -> Operating System;
4. Stars with -> specify your criteria ‘Windows Server *‘

Save the query and refresh the object list in the ADUC console. The list will show all Windows Server objects in your domain.

The saved queries are stored locally on the computer on which they were created. The XML file containing the settings is located here: C:\Users\%USERNAME%\AppData\Roaming\Microsoft\MMC\DSA). To transfer AD-saved queries between computers, there is a feature to import/export the queries as XML files in dsa.msc (Export Query Definition/Import Query Definition).

Useful Saved Query Examples for Active Directory MMC

The following table contains examples of commonly used LDAP queries to select Active Directory objects. You can save them to your ADUC console for daily use.

Using LDAP Filters in PowerShell

You can use the above LDAP filters to find AD objects in the PowerShell console. Most cmdlets from the PowerShell Active Directory module have a special LdapFilter parameter. You need to specify your LDAP query in this parameter. For example:

Get-ADUser -LdapFilter "(&(objectCategory=person)(objectClass=user)(department=*Sales department*))"| ft -a DisplayName,department

Get-ADUser, Get-ADComputer, and Get-ADGroup cmdlets are specialized cmdlets and used to find objects of a certain type – users, computers, or groups. If you don’t know the type of AD object you want, or if you need information about all types of objects, use the more common Get-ADObject cmdlet. For example, to search for an object by SID:

Get-ADObject -LdapFilter "(objectSID=S-1-5-21-87654321-12345678-5566443311-1231)" -Properties * -SearchBase “OU=DE,DC=woshub,DC=com"| ft -a DisplayName,Title