using LDAPS query in powershell

Question

using LDAPS query in powershell

shashidhar joliholi 281

Hi Team,

We are using following powershell cmdlets to get user info.

$AccountName = "Shashidhar.Joliholi"
$Query = "(&(objectClass=user)(objectCategory=person)(samAccountName=$AccountName))"
$UserInfo = Get-ADUser -LDAPFilter $Query

We are planning to block LDAP and go with LDAPS in DCs. does it impact above powershell script. if yes, what modification need to be done on the powershell cmdlets to use LDAPS to get $UserInfo.

can i use $UserInfo = Get-ADUser -LDAPFilter $Query -server dc.domain.com:636 ?

Need your help!

Thanks,
Shashidhar Joliholi

2 answers

Your answer

Answer 1

SChalakov 10,576 MVP Volunteer Moderator

Hi @shashidhar joliholi ,

No matter if you are using LDAP or LDAPS the query will always remain the same. The only difference is that the LDAP communication gets encrypted when using LDAPS.
You don't need to change anything regarding the query.

Hope I was able to answer your question.

----------

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards
Stoyan Chalakov

shashidhar joliholi 281 Reputation points

2022-03-10T12:21:58.44+00:00

Hi Stoyan,

Thanks for the comments. we are using -LDAPfilter to use LDAP queries in the powershell Get-ADUser. if we block LDAP
does -LDAPfilter works with LDAPS. ? or i need to modify anything in the script to communicate through LDAPS.

$UserInfo = Get-ADUser -LDAPFilter $Query -server dc.domain.com:636 ? do it works ?

Thanks,
Shashidhar Joliholi
SChalakov 10,576 Reputation points MVP Volunteer Moderator

2022-03-10T12:35:14.543+00:00

Hi Shashidhar,

yes, as already mentioned the only thing that changes with using LDAPs are the encrypted connection and also the port (like seen in your command).
You can find another exmaple here:

Powershell and LDAPS
https://social.technet.microsoft.com/Forums/scriptcenter/en-US/0d19f956-b8ce-4b3e-b987-cbba83fd89cc/powershell-and-ldaps?forum=ITCG

What is important of course is that all your domain controllers are configured for ldaps, meaning tehy have the required certificate.

You can test the ldaps connectivity to your DCs, using the function here:

Testing LDAP and LDAPS connectivity with PowerShell
https://evotec.xyz/testing-ldap-and-ldaps-connectivity-with-powershell/

Hope this clarifies it.

Regareds,
Stoyan

Answer 2

Gary Reynolds 9,621

Out of interest how are you planning to block the use of LDAP and what changes are you planning to make so clients only connect on LDAPS/636?

Gary.

Share via

using LDAPS query in powershell

2 answers

Your answer