Hi! I'm trying to filter entries that have the 'D' flag set in the sambaAcctFlags attribute: attributetype ( 1.3.6.1.4.1.7165.2.1.26 NAME 'sambaAcctFlags' DESC 'Account Flags' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{16} SINGLE-VALUE ) However, this attribute doesn't have a substring match rule, and normal substring filters don't seem to work. I don't know if that's possible on principle, but maybe an extensible search filter with a special matching rule can be used to accomplish this task? I've tried it with "(sambaAcctFlags:caseIgnoreSubstringsMatch:=*D*)" but substring filters are not allowed in extensible filters. Any hints? Thanks in advance, --leo -- e-mail ::: Leo.Bergolth (at) wu-wien.ac.at fax ::: +43-1-31336-906050 location ::: Computer Center | Vienna University of Economics | Austria