Using Wildcards in Search Filters

Microsoft® Windows® 2000 Scripting Guide

It is often necessary to locate all attributes that contain similar but not identical values so that these values can be modified. For example, you might need to locate all user accounts that start with the same network path in their user profile path, or user accounts with the same area code specified for their telephoneNumber attribute.

Scripting Steps

Listing 7.30 contains a script that finds all user accounts in the forest that contain a similar value for an attribute. To carry out this task, the script performs the following steps:

  1. Create an ADO Connection object to access the Active Directory database by using the ADSI OLE DB provider.

  2. Create an ADO Command object, and assign the ADO connection to it.

  3. Assign the query string to the CommandText property of the ADO Command object. The string uses LDAP search dialect.

    Line 8 specifies the search base by using the GC moniker to query the global catalog server in the Active Directory root domain, fabrikam.com, because the telephoneNumber and distinguishedName attributes are replicated to the global catalog.

    Line 9 specifies the search filters for the query. The objectCategory filter limits the query to all user account types. The telephoneNumber filter uses the any operator to limit the query to telephoneNumber attribute values starting with 707.

    Line 10 specifies the attributes of the objects to return, the distinguishedName and telephoneNumber attributes, and the scope of the search.

  4. Run the query by assigning the Execute method to the Command object and storing the return value in the RecordSet object, objRecordSet.

  5. Use an If Then Else statement to determine whether the recordset is empty by checking the EOF property of the RecordSet object. If EOF is true, display a message stating that no user accounts were found with the specified area code. Otherwise, display each record that starts with 707 for the telephoneNumber attribute.

  6. To display the records, use a While Wend statement to loop through all of the records in the RecordSet object. For each record, display the distinguishedName and telephoneNumber values stored in the Fields collection of the RecordSet object.

  7. Move to the next record in the recordset by using the MoveNext method of the RecordSet object. When all records are processed, end the loop.

  8. Close the Connection object.

Listing 7.30 Searching for User Accounts That Contain a Similar Value in an Attribute

  
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
Set objConnection = CreateObject("ADODB.Connection")
objConnection.Open "Provider=ADsDSOObject;"
Set objCommand = CreateObject("ADODB.Command")
objCommand.ActiveConnection = objConnection
objCommand.CommandText = _
 "<GC://dc=fabrikam,dc=com>;" & _
 "(&(objectCategory=person)(telephoneNumber=707*));" & _
 "distinguishedName,telephoneNumber;subtree"
Set objRecordSet = objCommand.Execute
If objRecordset.EOF Then
 Wscript.Echo _
 "No user accounts found with this area code."
Else
 Wscript.Echo "User account(s) with the specified area code:"
 While Not objRecordset.EOF
 Wscript.Echo objRecordset.Fields("distinguishedName") & ": " & _
 objRecordset.Fields("telephoneNumber")
 objRecordset.MoveNext
 Wend
End If
objConnection.Close

The example shown in Listing 7.30 uses a search filter that performs post-wildcard matching on an indexed attribute. In this example, post-wildcard matching means that all telephoneNumber attribute values that start with 707 are returned. Pre-wildcard matching, such as (telephoneNumber=*707-9794), and mid-wildcard matching, such as (telephoneNumber=425*9794), should not be performed against a potentially large result set. This is because the server performs significantly more processing to return such a result set than to return a result set from a post-wildcard match. If you must perform a pre- or mid-wildcard match, consider limiting the search to a smaller search base and search scope.