DSQUERY

Queries Active Directory according to specified criteria.

DSQUERY { * | computer | contact | group | ou | partition | quota | server | site | subnet | user} /?

DSQUERY * [{start_node_nd | domainroot | forestroot}] [-attr {attribute_list | *}] [-attrsonly] [-filter ldap_filter] [-gc] [-l] [-limit number_of_objects] [-p {password | *}] [-q] [-r] [{-s server | -d domain}] [-scope {base | onelevel | subtree}] [-u user_name] [-uc | -uci | -uco]

DSQUERY computer [{start_node_nd | domainroot | forestroot}] [-desc description] [-disabled] [-gc] [-inactive number_of_weeks] [-limit number_of_objects] [-name name] [-o {dn | rdn | samid}] [-p {password | *}] [-q] [-r] [-samid sam_name] [-scope {base | onelevel | subtree}] [-stalepwd number_of_days] [{-s server | -d domain}] [-u user_name] [-uc | -uci | -uco]

DSQUERY {contact | ou} [{start_node_nd | domainroot | forestroot}] [-desc description] [-gc] [-limit number_of_objects] [-name name] [-o {dn | rdn}] [-p {password | *}] [-q] [-r] [-scope {base | onelevel | subtree}] [{-s server | -d domain}] [-u user_name] [-uc | -uci | -uco]

DSQUERY group [{start_node_nd | domainroot | forestroot}] [-desc description] [-gc] [-limit number_of_objects] [-name name] [-o {dn | rdn | samid}] [-p {password | *}] [-q] [-r] [-samid sam_name] [-scope {base | onelevel | subtree}] [{-s server | -d domain}] [-u user_name] [-uc | -uci | -uco]

DSQUERY partition [-gc] [-limit number_of_objects] [-o {dn | rdn}] [-p {password | *}] [-q] [-part part_cn] [-r] [{-s server | -d domain}] [-u user_name] [-uc | -uci | -uco]

DSQUERY quota [{start_node_nd | domainroot}] [-acct name] [-desc description] [-gc] [-limit number_of_objects] [-o {dn | rdn}] [-p {password | *}] [-q] [-qlimit value] [-r] [{-s server | -d domain}] [-u user_name] [-uc | -uci | -uco]

DSQUERY server [-desc description] [-domain domain_name] [-forest] [-gc] [-hasfsmo {infr| name | pdc | rid | schema}] [-isgc] [-limit number_of_objects] [-name name] [-o {dn | rdn}] [-p {password | *}] [-q] [-r] [-site site_name] [{-s server | -d domain}] [-u user_name] [-uc | -uci | -uco]

DSQUERY site [-desc description] [-gc] [-limit number_of_objects] [-name name] [-o {dn | rdn}] [-p {password | *}] [-q] [-r] [{-s server | -d domain}] [-u user_name] [-uc | -uci | -uco]

DSQUERY subnet [-desc description] [-gc] [-limit number_of_objects] [-loc location] [-name name] [-o {dn | rdn}] [-p {password | *}] [-q] [-r] [{-s server | -d domain}] [-u user_name]

DSQUERY user [{start_node_nd | domainroot | forestroot}] [-desc description] [-disabled] [-gc] [-inactive number_of_weeks] [-limit number_of_objects] [-name name] [-o {dn | rdn | samid | upn}] [-p {password | *}] [-q] [-r] [{-s server | -d domain}] [-samid sam_name] [-scope {base | onelevel | subtree}] [-stalepwd number_of_days] [-upn upn] [-u user_name] [-uc | -uci | -uco]

* (NTXP)

Finds any objects in the directory according to criteria using an LDAP query.

computer (NTXP)

Finds computers in the directory that match specified search criteria.

contact (NTXP)

Finds contacts in the directory that match the specified search criteria.

group (NTXP)

Finds groups in the directory that match the specified search criteria.

start_node_nd | domainroot | forestroot (NTXP)

Specifies the node where the search will start:

• domainroot domain root, default
• forestroot forest root, search done using the global catalog
• start_node_dn a node's distinguished name

ou (NTXP)

Finds organizational units in the directory that match the specified search criteria.

partition (NT2003)

Finds partition objects in the directory that match the specified search criteria.

quota (NT2003)

Finds quota specifications in the directory that match the specified search criteria.

server (NTXP)

Finds domain controllers according to specified search criteria.

site (NTXP)

Finds sites in the directory matching specified search criteria.

subnet (NTXP ONLY)

Finds subnets in the directory matching specified search criteria.

user (NTXP)

Finds users in the directory that match the specified search criteria.

/? (NTXP)

Display help.

-acct name (NT2003)

Specifies to find the quota specifications assigned to the security principal security principal (user, group, computer, or InetOrgPerson) as represented by name:

• Distinguished Name (DN) of the security principal
• Domain\SAMAccountName of the security principal

-attr {attribute_list | *} (NTXP)

Specifies that the semicolon separated LDAP display names included in attribute_list are the only attributes for each entry in the result set that should be displayed. If *, then all attributes present on the object in the result set are displayed in the default output format - list format, regardless of whether -l is specified. Default attribute_list is a distinguished name.

-attrsonly (NTXP)

Specifies that only the attribute types present on the entries in the result set, and not their values, should be displayed. The default is to display both the attribute type and the value.

-d domain (NTXP)

Connects the computer to a specified domain. By default, the computer is connected to the domain controller in the logon domain.

-desc description (NTXP)

Searches for computers/contacts/groups/organizational units/server objects/sites/subnets/users whose description attribute matches description.

-disabled (NTXP)

Searches for all computers/users whose accounts are disabled.

-domain domain_name (NTXP)

Searches for all domain controllers (server objects) that are part of the domain whose DNS name is given by domain_name. Note that this is not necessary if all domain controllers in the current domain are to be displayed, since that is the search criterion when no other criterion is specified.

-filter ldap_filter (NTXP)

Specifies an explicit search filter ldap_Filter specified in the LDAP search filter format to be used for this search. Default is (objectClass=*).

-forest (NTXP)

Specifies that the search use the Active Directory global catalog.

-gc (NTXP)

Specifies that the search use the Active Directory global catalog.

-hasfsmo {infr| name | pdc | rid | schema} (NTXP)

Searches for the domain controller (server object) that holds the requested operations master role:

• infr requests the infrastructure master of the forest if no domain specified with -domain, or use current domain
• name requests the domain naming master of the forest
• pdc requests the primary domain controller (PDC) role owner of the domain given by the -domain (or the current domain is used)
• rid requests the relative ID master (RID master) of the domain given by the -domain (or the current domain is used)
• schema requests the schema master of the forest

-inactive number_of_weeks (NTXP)

Searches for all computers/users that have been inactive (stale) for the specified number_of_weeks.

-isgc (NTXP)

Searches for all domain controllers (server objects) in the scope specified by any of: -forest, -domain, or -site that are global catalog servers. If none of the above scope parameters are specified, then find all global catalogs in the current domain.

-l (NTXP)

Displays entries in a list format. By default, entries are displayed in a table format.

-limit number_of_objects (NTXP)

Specifies the number of objects that match the given criteria to be returned. If the value of number_of_objects is 0, all matching objects are returned. If omitted, by default the first 100 results are displayed.

-loc location (NTXP)

Searches for subnets whose location attribute matches location.

-name name (NTXP)

Searches for computers/contacts/groups/organizational units/server objects/sites/subnets/users whose name (CN) attributes matches name.

-o {dn | rdn | samid} (NTXP)

Specifies the format in which the list of entries found by the search will be displayed:

• dn distinguished name of each entry, default
• rdn relative distinguished name of each entry
• samid SAM account name of each entry computer group server user
• upn user principal name of each entry user

-p {password | *} (NTXP)

Specifies to use either a password or a * to log on to a remote server. If *, then prompted for password.

-part part_cn (NT2003)

Finds partition objects whose common name (CN) matches the filter given by part_cn.

-q (NTXP)

Suppresses all output to standard output (quiet mode).

-qlimit value (NT2003)

Specifies to find quota specifications whose limit matches value.

-r (NTXP)

Specifies that the search use recursion or follow referrals during search. By default, the search will not follow referrals during search.

-s server (NTXP)

Connects the computer to a specified server.

-samid sam_name (NTXP)

Searches for computers/groups/users whose SAM account name matches sam_name.

-scope {base | onelevel | subtree} (NTXP)

Specifies the scope of the search:

• base single object represented by start node
• onelevel immediate children of start node only
• subtree subtree rooted at start node, default

If forestroot is specified as StartNode, subtree must be used.

-site site_name (NTXP)

Searches for all domain controllers (server objects) that are part of site site_name.

-stalepwd number_of_days (NTXP)

Searches for all computers/users that have not changed their password for the specified number_of_days.

-u user_name (NTXP)

Specifies the user name with which user will log on to a remote server. By default, the logged on user name is used. You can specify a user name using one of the formats:

      user name
      domain\user name
      user principal name (UPN)

-uc | -uci | -uco (NT2003)

Specifies that output or input data is formatted in Unicode:

• -uc input from or output to a pipe (|)
• -uco output to a pipe (|) or a file
• -uci input from a pipe (|) or a file

-upn upn (NTXP)

Searches for users whose UPN attribute matches UPN.

none.

none.

none.

none.

External

DOS

none

Windows

none

Windows NT

NTXP NT2003