Looking for a command line or simple script to identify AD users.

[Steven E. Protter]

We have two kinds of users. local (root, and such) and AD integrated users.

I would like to identify AD integrated users if possible to create an automated security report.

awk '{print $1} /etc/passwd | while read -r uid

do

    <Insert command here to determine if its a local or AD integrated user>

done

Thanks,

SEP

[Dennis Handly]

>awk '{print $1} /etc/passwd | while read -r uid; do

I'm not sure this will work for LDAP users?

It doesn't work for NIS, you need to use "ypcat passwd" instead.

[Matti_Kurkela]

Well, if the user is listed in /etc/passwd, then I think the user *is* local by definition, although there might be overlapping information in the AD.

The "nsquery" command might be the one you want.
By default, it follows the nsswitch.conf policy, so it will give you the same answers the regular programs will get.

But you can use it to query using a custom lookup policy, e.g. telling the system to look up using AD/LDAP only, or /etc/passwd only:

• If you run "nsquery passwd joeuser ldap" and get an answer, then this user is defined in LDAP (and AD is a special case of LDAP). If you get a return value of 3, there was no Unix username "joeuser" listed in LDAP/AD.
• if you run "nsquery passwd joeuser files" and get an answer, then this user is defined in /etc/passwd. Again, a return value of 3 means the user either is not defined locally or does not exist at all.
• if both of the above commands return an answer, you have both a local *and* a LDAP definition for the user. Hopefully they have identical information...