Filter
Parses an RFC 4515 search filter and shows it normalized and pretty-printed, with a plain-English reading and advice. A parse error points at the character where parsing failed.
The escape tools convert a value to and from the \XX form used inside filters, so *, (, ) and \ match literally.
Cannot do: check the filter against a directory, or know which attributes are indexed on your server.
DN
Splits a distinguished name into its RDNs, from leaf to base, and shows the normalized form, the canonical name (domain/OU/CN), the DNS domain from the DC components and the parent chain.
Compare reports Same when two DNs name the same object after normalization. Attribute types are case-insensitive, and values are compared case-insensitively here.
Domain and DN converts corp.example.test to DC=corp,DC=example,DC=test and back.
AD recipes
Builds common Active Directory filters from a recipe and its parameters. The output is the filter, a note where the recipe needs one, and a plain-English reading. Open in Filter tab sends the filter to the Filter tab.
Matching rule OIDs used by the recipes
1.2.840.113556.1.4.803 LDAP_MATCHING_RULE_BIT_AND: every listed bit must be set. Used for userAccountControl flags.1.2.840.113556.1.4.804 LDAP_MATCHING_RULE_BIT_OR: any listed bit must be set.1.2.840.113556.1.4.1941 LDAP_MATCHING_RULE_IN_CHAIN: follows nested group membership (memberOf) or parent links.
Cost: LDAP_MATCHING_RULE_IN_CHAIN is expensive on large groups and deep trees. Narrow the search base, and avoid it in filters that run often.
UAC and time
userAccountControl is a bit field. Enter a number or tick flags to compute it. Bit 0x2 (ACCOUNTDISABLE) decides whether the account is enabled. Bits this tool does not know are shown as unknown and kept when you tick flags.
Timestamps accept Windows FILETIME (100 ns ticks since 1601 UTC), LDAP GeneralizedTime, Unix seconds or milliseconds, or an ISO date, and show every format.
Special values: 0 in a FILETIME attribute usually means not set. 9223372036854775807 means never expires (for example accountExpires).
Keyboard
- ? opens this help when you are not typing in a field.
- Esc closes Help.
- Arrow keys move between sub-tabs.