Hi Dennis, > ldapsearch -x -LLL '(&(objectClass=device)(sambaAcctFlags=*S*))' dn Take a look at samba.schema file [1]. No SUBSTR matching rule is defined for sambaAcctFlags. Therefore this will not work. But I think it can be easily added. Jan [1] http://gitweb.samba.org/?p=samba.git;a=blob;f=examples/LDAP/samba.schema