Skip to main content

Published: April 17, 2012

Updated: April 17, 2012

Applies To: Windows 8, Windows Server 2008, Windows Server 2012

Performs operations such as connect, bind, search, modify, add, delete against any Lightweight Directory Access Protocol (LDAP)-compatible directory, such as Active Directory Domain Services (AD DS). Ldp is an LDAP client that you use to view objects that are stored in AD DS along with their metadata, such as security descriptors and replication metadata.

Ldp is a graphical user interface (GUI)-based, Windows Explorer–like tool with a scope pane on the left that is used for navigating through the Active Directory namespace, and a details pane on the right that is used for displaying the results of the LDAP operations. Any text that is displayed in the details pane can be selected with the mouse and copied to the Clipboard.

Ldp is built into Windows Server 2008. It is available if you have the AD DS server role installed. To start ldp, click Start, click Run, type ldp and then click OK.

For examples of how to use this command, see Examples.

Finding required and optional values for an attribute

The schema defines objects as well as the attributes and permissible values for each. Schema classes that contain attribute information about objects can be viewed. To view this information, search cn=Schema,cn=Configuration,dc=ForestRootDomain for classSchema objects.

Understanding bind options for LDAP authentication

There are several authentication methods available in ldp that allow a client to bind to an LDAP server. The best method depends on several factors.


Method Description


Cleartext password. Try not to use this, as it is not secure.


MSN (Microsoft Network) authentication. This package brings up a dialog box to prompt the user for MSN credentials.


Normandy authentication, new MSN authentication. Same usage as MSN.


Windows NT domain authentication. Use NULL credentials and attempt to use default logged-in user credentials.


Negotiate with the server for any of: MSN, DPA, NTLM. Should be used for LDAPv2 servers only.


Use GSSAPI Negotiate package to negotiate security package of either Kerberos V5 or NTLM (or any other package the client and server negotiate). Pass in NULL credentials to specify default logged-in user. If Negotiate package is not installed on server or client, this will fall back to Sicily negotiation.


Example 1: Add a new object to an LDAP directory

To add a user to Active Directory by using ldp:

  1. On the Browse menu, click Add child.

  2. In the Add dialog box, in the Dn input box, enter the distinguished name of the new object.

  3. In the Edit Entry section, add the new attributes and values. Click Enter after typing in each attribute and associated value:


    Attribute Value







  4. To add the attribute or value combination to the Entry List box, click Edit.

  5. To add the information to Active Directory using LDAP APIs when all the attributes are entered, click Run.

Example 2: Search an LDAP directory

To search Active Directory by using ldp:

  • On the Browse menu, click Search.

    The Search dialog box opens.

In the following searches, the LDAP directory is AD DS. For user names, it contains a givenName attribute for first names, and an attribute of sn for last names.

  • To search for all users that have a first name of John and a last name of either Smith or Jones, type the following in the Filter field:

  • To search for users that have a last name of Jones, but filter out those users that have a first name of John or Jane, and also filter out users that have not logged on at least 100 times, type the following in the Filter field. (The exclamation point (!) is the NOT operator.)

  • To search for reserved characters as part of an attribute value, you must precede the reserved character with an escape character. Use the following escape characters to represent the associated characters:


    Character Escape character











  • To search for all of the users whose display names end in a close parenthesis character, type the following in the Filter field:

  • To search for all users who have a surname that starts with the letter J, type the following in the Filter field. (Queries support the wildcard character (*).)

  • To search for users whose home directories are G:\Accounting, type the following in the Filter field. (The attribute name is home-directory.)


Example 3: Control the returns on a search of an LDAP directory

In this example, you use the Search Options dialog box to control which attributes are displayed in a search. Just a few attributes are displayed; the rest are filtered and do not display in the details window of ldp.

To control which attributes display:

  • In the Attributes input box, type the attributes to display:

    Separate attributes with a semicolon. No spaces are necessary. All other attributes will be filtered out of the display.

    A range is specified for the memberof attribute. Because a semicolon is used, the entire section must be separated from the rest of the attributes by quotation marks.

All searches display only the memberof, objectClass, and objectGUID attributes in the details pane. To return all attributes, replace any existing list of attributes with the wildcard character (*).

Example 4: View replication metadata for an object

To list the replication metadata for an object in Active Directory:

  1. On the Browse menu, point to Replication and then click View Metadata.

    The Replication Metadata dialog box opens.

  2. In the Object DN field, enter the distinguished name of the object, and then click OK.

    The output will look similar to the output in the following table.


    AttID Ver Loc.USN Originating DSA Org.USN Org.Time/Date






    2000-12-29 09:15.02






    2000-12-29 09:15.02






    2000-12-29 09:15.02






    2000-12-29 09:15.02






    2000-12-29 09:15.02