AdFind

Summary

Command line Active Directory query tool. Mixture of ldapsearch, search.vbs, ldp, dsquery, and dsget tools with a ton of other cool features thrown in for good measure.

Warranty

See warranty.

PlatForms

Current Version

Version 1.37.00 - June 24, 2007

Modification(s) from previous version

Security Requirements

There are no local security requirements for running AdFind. Information returned from Active Directory and AD/AM will be dependent on the security configured for the directory. Generally a normal Active Directory user can return a considerable amount of information from Active Directory while AD/AM tends to be a little more locked down.

The -showdel option will require permissions to see into the cn=Deleted Objects container. By default, this requires administrator permissions. It can be modified but it is involved.

The STATS control options (stats, stats+, statsonly, stats+only) require the user to have DEBUG_PRIVILEGE on the server being queried. This generally means admin access is required to use that functionality.

The -sdna (Security Descriptor Non-Admin) or -nosacl options can be used to tell LDAP to not return the SACL portion of the ACL. This will allow users without auditing rights to retrieve most of the Security Descriptor of an object. Specifically, the Owner, Group Owner, and DACL information will be returned. If you attempt to use -sddl,-sddc,-owner* options and you don't get the information returned, add the -sdna option to see if that helps.

Language

C++. Compiled with Borland Builder 6.0

Source Code Availability

None

Story

AdFind was put together when I finally got sick of the limitations in ldapsearch and search.vbs and didn't want to continue writing quick vbscript solutions every time I needed some generic info. Plus, anyone will tell you vbscript doesn't handle several of the attributes in Active Directory very well. Some time after I had this tool out there for some time, Microsoft introduced dsquery and dsget. While they are nice tools, adfind continues to be more flexible and I rarely, if ever, use the ds* tools. I did, however, like the ability to pipe the results from the query into other command line tools so I emulated that functionality from the ds* series with adfind with the -dsq option. One day I realized that I could take the piping one step further and worked out the -adcsv option which when combined with AdMod is extremely powerful for doing updates to AD. 

V01.31.00 added a bunch of new changes, some of these changes include shortcut options. You can view information on the shortcut options with the new help screen available through /????. The story behind these shortcut options where that there were queries I was doing on a regular basis that I hated typing up the whole command for, for example, one of my most common queries is to check a schema object for its definitions which would normally take the command adfind -schema -f "|(name=objectname)(ldapdisplayname=objectname)" and now it is as simple as adfind -sc s:objectname. Another common one for me is listing all of the schema objects with a specific prefix which normally would look like adfind -schema -f "|(name=prefix*)(ldapdisplayname=prefix*)" -sort -list ldapdisplayname and now it is adfind -sc sl:prefix*. Anyway there are a ton of shortcuts, have fun.

Add-Ons

ADCSV.PL - Perl script to convert a full ADFIND output dump to CSV style format. Included in ZIP file for AdFind. No I will not rewrite this in vbscript. I dislike vbscript. I have received a couple of vbscript scripts to do this, I will not include them as I will only include stuff that I have done so I am only answering questions on stuff I wrote. If you only need to export specific attributes, specify those attributes and use the -csv option to get CSV output natively.

Download

You do not have to supply the email address. I would like you to fill that in though so that I have an idea on how popular a tool really is. If I see 1000 downloads with 900 different email addresses I know it is more widespread than one that has 1000 downloads and 200 different email addresses because the same person needed to keep downloading it for some reason.

Email Address: Optional
 

Version History

As seen in

Usage

    Download and type adfind /? for basic usage

See current usage screens