lastLogonTimeStamp parameter LDAP filters in domain.conf

Randy Moore

18. jouluk. 2020, 14.44

Has anyone successfully used the lastLogonTimeStamp parameter LDAP filters in your domain.conf to filter users by their last login time?  I need to confirm the syntax of those LDAP filters.  I have tried using the syntax in the ADI FAQ question #31. and my ADI sync is archiving every existing user in the domain even though my lastLogonTimeStamp value should be syncing several thousand users according to the values from Active Directory.  I'm assuming I have the syntax wrong but I don't have any other examples to follow other than in the KB.  Are you willing to share your lastLogonTimeStamp syntax.  Below is what I'm using.

filter_users_by_ou = "(&(lastLogonTimeStamp>=132184707960000000)(objectCategory=person)(objectClass=user)(mail=*)(!userAccountControl:1.2.840.113556.1.4.803:=2)(!cn=HealthMailbox*)(!cn=SystemMailbox*))(&(objectCategory=person)(objectClass=user)(mail=*)(!userAccountControl:1.2.840.113556.1.4.803:=2)(!cn=HealthMailbox*)(!cn=SystemMailbox*))"
filter_users_by_name = "(&(objectCategory=person)(objectClass=user)(!userAccountControl:1.2.840.113556.1.4.803:=2)(!cn=HealthMailbox*)(!cn=SystemMailbox*)(|{DYNAMIC_CONTENT}))"
filter_users_by_group = "(&(lastLogonTimeStamp>=132184707960000000)(objectCategory=person)(objectClass=user)(mail=*)(!userAccountControl:1.2.840.113556.1.4.803:=2)(!cn=HealthMailbox*)(!cn=SystemMailbox*)(|{DYNAMIC_CONTENT}))(&(objectCategory=person)(objectClass=user)(mail=*)(!userAccountControl:1.2.840.113556.1.4.803:=2)(!cn=HealthMailbox*)(!cn=SystemMailbox*)(|{DYNAMIC_CONTENT}))"

0

• 

  Randy Moore 11. tammik. 2021, 13.38

  This was resolved by KnowBe4 support.  They recommended the following syntax:

  filter_users_by_ou = "(&(lastLogonTimestamp>=132184707960000000)(objectCategory=person)(objectClass=user)(mail=*)(!userAccountControl:1.2.840.113556.1.4.803:=2)(!cn=HealthMailbox*)(!cn=SystemMailbox*))"
  
  filter_users_by_group = "(&(lastLogonTimestamp>=132184707960000000)(objectCategory=person)(objectClass=user)(mail=*)(!userAccountControl:1.2.840.113556.1.4.803:=2)(!cn=HealthMailbox*)(!cn=SystemMailbox*)(|{DYNAMIC_CONTENT}))"

  0

  Kommenttitoiminnot Pysyvä linkki

Kirjaudu sisään jättääksesi kommentin.