Question

I am currently working on a PHP script that will be polling Active Directory to pick out modified objects (people/users), via LDAP.

I’m able to filter on uSNChanged when I have the value, like so:

$previousUsn = '1234';
$ldapCon = ldap_connect('ldap-host');
$ldapBind = ldap_bind($ldapCon, 'ldap-user', 'ldap-password');
$sr = ldap_search($ldapCon, "ou=Users,dc=foo", "uSNChanged >= $previousUsn");

According to this, I should be able to retrieve a highestCommittedUSN attribute that could be used for the initial run of the script. I’ve been looking around to find out how this can be done using PHP & LDAP, but to no avail.

Alternatively, feel free to suggest completely different methods of retrieving changes in AD.

Answer 1

ldap_read(...) seems to do the trick:

function getHighestCommittedUsn() {
    ldap_bind(...);
    $sr = ldap_read($ldapCon, null, "(highestcommittedusn=*)", array("highestcommittedusn"));
    $rs = ldap_get_entries($ldapCon, $sr);

    return $rs[0]["highestcommittedusn"][0];
}