Understanding AD LDAP Bitmasks
Active Directory stores many account status flags inside a single integer attribute called userAccountControl (UAC). To filter by these flags in LDAP, you cannot use simple equals signs; you must perform a bitwise AND operation. LDAP achieves this using two special matching rule OIDs:
1.2.840.113556.1.4.803(LDAP_MATCHING_RULE_BIT_AND): Matches if all bits in the bitmask are set.1.2.840.113556.1.4.804(LDAP_MATCHING_RULE_BIT_OR): Matches if any bit in the bitmask is set.
For example, to find disabled accounts, we look for flag value 2 (ADS_UF_ACCOUNTDISABLE). The LDAP filter is: (userAccountControl:1.2.840.113556.1.4.803:=2)
Recursive Group Membership (LDAP Chain Rule)
By default, querying (memberOf=CN=MyGroup,...) only returns direct members of that group. If "MyGroup" contains other groups, their members are excluded. Active Directory supports a special OID 1.2.840.113556.1.4.1941 (LDAP_MATCHING_RULE_IN_CHAIN) which performs a recursive search of the group hierarchy. Example:(memberOf:1.2.840.113556.1.4.1941:=CN=MyGroup,...)