Search deleted users/groups in AD with python-ldap

Question

If you delete an user or group in windows AD, it will in “DElETE objects”.
I want to use python ldap lib to get them.
Code:

<code>
import ldap
uri = "ldap://10.64.74.17"
user = "XXXXXXXXXX"
password = "XXXXXXXXXXXX"
ldap.set_option(ldap.OPT_REFERRALS, 0)
ldap.set_option(ldap.OPT_NETWORK_TIMEOUT, 5)
ldap.protocol_version = 3
ldapClient = ldap.initialize(uri)
ldapClient.simple_bind_s(user, password)
filter = "(&(objectclass=person)(isDeleted=true)(!(objectclass=computer)))"
results = ldapClient.search_s("DC=xx,DC=com", ldap.SCOPE_SUBTREE,filter)
for result in results:
  print result
ldapClient.unbind_s()
</code>

It can’t show deleted objects.
What’s wrong with this code?

Asked By: carlos chen

||

Source

Answer 1

You need to add an ldap control to your search : create the request control for the particular operation, and then pass a collection of controls to your search request as an optional parameter.

In your case, this OID for AD is 1.2.840.113556.1.4.417.

LDAP_SERVER_SHOW_DELETED_OID : 1.2.840.113556.1.4.417

Used with an LDAP operation to specify that tombstones and deleted-objects are visible to the operation.

tombstone_control = ('1.2.840.113556.1.4.417',criticality=1)
results = ldapClient.search_s("DC=xx,DC=com", ldap.SCOPE_SUBTREE,filter, [tombstone_control])

You can also scope your search base to CN=Deleted Objects, DC=xx,DC=com as this is where all deleted objects end up. You should make sure your deleted objects are there first. You can use ldp.exe to check.

Answered By: Dave Bennett

Search deleted users/groups in AD with python-ldap

Question:

Answers: