mmadquery command

Queries and validates Active Directory (AD) server settings.

Synopsis

mmadquery list {user | uids | gids | groups | dc | trusts | idrange} [Options]

mmadquery check {uids | gids | idrange} [Options]

mmadquery stats {user |uids}

Availability

Available on all IBM Spectrum Scale editions.

Description

Use the mmadquery command to query an AD Server for users, groups, user IDs, group IDs, known domain controller and trusts, and to run consistency checks.

Parameters

user

Queries and lists the defined users.

uids

Queries and lists the defined users with user IDs and group IDs.

gids

Queries and lists the defined groups with group IDs.

groups

Queries and lists the defined groups.

dc

Queries and lists the defined domain controllers.

trusts

Queries and lists the defined trusts.

idrange

Queries and lists the ID range used by a given AD server.

Options

--server SERVER: Specifies the IP address of the AD server you want to query. If you do not specify a server, mmadquery attempts to get the AD server from the /etc/resolv.conf file (nameserver).
Note: This option should be used along with the domain option, which is provided in the following section.
--domain DOMAIN: Specifies the Windows domain. If you do not specify a domain, mmadquery uses nslookup to determine the domain based on the server.
Note: This option should be used along with the server option.
--user USER: Specifies the AD user used to run the LDAP query against the AD server. The default is Administrator.
--pwd-file File: Specifies the file that contains a password to use for authentication.
--filter FILTER: Specifies a search phrase to limit the number of LDAP objects, thus is applied only to first column of output. Every LDAP object beginning with the search phrase is queried.
--CSV: Shows output in machine parseable (CSV) format.
-Y: Displays the command output in a parseable format with a colon (:) as a field delimiter. Each column is described by a header.
Note: Fields that have a colon (:) are encoded to prevent confusion. For the set of characters that might be encoded, see the command documentation of mmclidecode. Use the mmclidecode command to decode the field.
--debug or -d: Shows debugging information
--basedn or -b: Includes basedn for LDAP objects queried in query output. This option is not supported when querying idrange or running a 'stats' query.
--traverse: Traverses all known domains and provide query output for all domains that are detected.
--long or -L: Indicates that you want to see more details. For more information, see Level of query detail below. This option is not supported for the "stats" queries.

Level of query detail

Table 1. Query details by type
Query	Additional content
User	Group membership
DC	Operating system
UIDs	GID, Primary Group ID
Trusts	DC

Exit status

0: No errors found.
1: No arguments specified.
10: Failed a check.
11: Unable to determine the AD server to check.
12: Unable to determine the domain.
13: Failed to construct a basedn for an LDAP query.
99: Access to the AD server failed, can be incorrect password, user, or domain.

Security

You must have root authority to run the mmadquery command. For more information, see Requirements for administering a GPFS file system.