Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Using Saved Queries
You can get to the Active Directory Users and Groups management console from the Domains and Trusts console by right-clicking the domain controller and selecting Manage. You should see a screen similar to the one in Figure 3, showing the DC root node expanded in the left pane of the management console. One noticeable difference from AD 1.0 is a new folder at the top (above the domain controller listing) called Saved Queries. This new feature enables you to create, edit, import, or export queries that perform administrative tasks: finding out which user accounts are disabled, determining the number of days since a user last logged on, tracking down returning users with non-expiring passwords, and so on.
)
Figure
3 Users and Computers console.
Because AD is actually a database that stores attributes of objects, performing a query against the AD database is conceptually similar to performing an SQL query against an Access database or SQL Server database. The main difference is that AD uses Lightweight Directory Access Protocol (LDAP) rather than SQL as the query language. To make life easier, Windows Server 2003 generates AD queries by constructing the proper LDAP filter (or query) for you.
To start a query, right-click the Saved Queries folder and select New (see Figure 4). Figure 5 shows a simple query I constructed that returns all Secretary accounts on my network. (When setting up secretary accounts on my network, I'm careful to set each secretary's account description field to contain only one word, secretary, which then becomes the search key for my query.) By default, the query root is my domain. Figure 6 shows the generated LDAP query. When I click OK, the query definition appears under the Saved Queries folder in the left pane of the console. I can now edit or export this query definition to an XML file that can then be imported to the Saved Queries container of another AD domain, if necessary. Click the Refresh button at the top, and Windows displays in the right pane the results of the new query.
)
Figure
4 Generating a new query.
)
Figure
5 Defining the query parameters.
)
Figure
6 Viewing the generated query string.
You can see from just this simple example how powerful your queries could become and how much easier life is for administrators who are performing account monitoring and other tasks against AD.