-
Title
Query used in Recovery Manager to determine number of enabled users in the license -
Description
How to check the number of enabled user accounts in AD the same way as it is performed by Recovery Manager for AD? -
Resolution
Recovery Manager for AD licensing is based on the total number of enabled user accounts in Active Directory domains that are being backed up with this product. Below is the query that Recovery Manager for AD uses to count the enabled user objects:- Open Active Directory Users and Computers select your domain (domain_name.com)
- Right click you domain (Domain_name.com) andselect Find
- In the Find option specify Custom Search
- Click Advanced tab
- Copy and paste the query into the Enter LDAP queryPre RMAD 8.2.1 use the following query:
(samAccountType=805306368)(objectSid=*)(!userAccountControl:1.2.840.113556.1.4.803:=2)The query was modified in version 8.2.1 of the product to exclude Intel vPro computer accounts. Below is the query used in 8.2.1, and 8.5.x:
(&(samAccountType=805306368)(objectSid=*)(!userAccountControl:1.2.840.113556.1.4.803:=2)(|(!objectclass=computer)(!serviceprincipalname=*:16993*)))
Below query is for version 8.6.1 - 8.6.4 (which excludes HP Integrated Lights-Out service accounts):
(&(samAccountType=805306368)(objectSid=*)(!userAccountControl:1.2.840.113556.1.4.803:=2)(!objectclass=computer)(!objectclass=hpqTarget))
Below query is used in 8.7 and later:
(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=512)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
-
Additional Information
If you have more than 10000 enabled user objects, you will need to use Powershell or another utility that allows you to run LDAP queries due to the 10000 object limit imposed on ADUC. To run the same queries using Powershell: Pre 8.2.1: (dsquery * -filter "(samAccountType=805306368)(objectSid=*)(!userAccountControl:1.2.840.113556.1.4.803:=2)" -attr samaccountname -attrsonly -limit 0).count 8.2.1 and 8.5.x: (dsquery * -filter "(&(samAccountType=805306368)(objectSid=*)(!userAccountControl:1.2.840.113556.1.4.803:=2)(|(!objectclass=computer)(!serviceprincipalname=*:16993*)))" -attr samaccountname -attrsonly -limit 0).count 8.6.1 - 8.6.4: (dsquery * -filter "(&(samAccountType=805306368)(objectSid=*)(!userAccountControl:1.2.840.113556.1.4.803:=2)(!objectclass=computer)(!objectclass=hpqTarget))" -attr samaccountname -attrsonly -limit 0).count 8.7 and later: (dsquery * -filter "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=512)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))" -attr samaccountname -attrsonly -limit 0).count