LDAP query cost is driven mainly by search scope, result size, and requested attributes. We keep engagement queries tight: specific filters, specific attributes, paging enabled, no * plus nTSecurityDescriptor unless we intentionally need a heavy pull.
Minimal ACL-relevant attributes:
sAMAccountType
distinguishedName
objectSid
nTSecurityDescriptor
Better broad user pull:
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -E pr=1000/noprompt -o ldif-wrap=no -b "$BASE" '(&(samAccountType=805306368)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))' sAMAccountName distinguishedName memberOf adminCount servicePrincipalName userAccountControl
Avoid this unless deliberately collecting ACL-heavy data:
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -E pr=1000/noprompt -b "$BASE" '(|(objectClass=domain)(objectClass=organizationalUnit)(objectClass=groupPolicyContainer))' '*' nTSecurityDescriptor
Prefer targeted ACL pulls:
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b 'CN=svc_web,OU=Service Accounts,OU=OOTW Lab,DC=ootw,DC=local' -s base distinguishedName objectSid nTSecurityDescriptor
Use paged searches:
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -E pr=1000/noprompt -o ldif-wrap=no -b "$BASE" '(objectClass=*)' distinguishedName
Prefer server-side filters over shell-side filtering:
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(&(samAccountType=805306368)(servicePrincipalName=*)(!samAccountName=krbtgt)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))' name sAMAccountName servicePrincipalName