LDAP query for deleted users

Question

The normal way to query a directory for users is (&(objectClass=user)(objectCategory=person)). The normal way to query for deleted objects is to add (isDeleted=TRUE).

However, the objectCategory attribute does not exist on tombstone objects, so a query for (&(objectClass=user)(objectCategory=person)(isDeleted=TRUE)) will get you nothing.

If you remove the (objectCategory=person) part, you'll get computers too, as they inherit from user.

Is it possible to retrieve only deleted users?

If not, is it possible to tell from the returned tombstone object if it's a user or not?

Answer 1

Try an LDAP filter like:

(&(isDeleted=TRUE)(userAccountControl:1.2.840.113556.1.4.803:=512))

This should retrieve most deleted user type entries.

Answer 2

python3 code

import ldap
from ldap.controls.simple import ValueLessRequestControl
...
base = 
scope = ldap.SCOPE_SUBTREE
filterstr = '(&(objectClass=user)(isDeleted=TRUE))'
attrlist = 
result_set = []
ct = ldap.controls.simple.ValueLessRequestControl('1.2.840.113556.1.4.417', True)
result_id = l.search_ext(base, scope, filterstr, attrlist, serverctrls=[ct, ])
for i in range(0, 100):
    result_type, result_data = l.result(result_id, 0)
    if result_type == ldap.RES_SEARCH_ENTRY:
        result_set.append(result_data)
    else:
        break
...

---