[ActiveDir] Querying for all users

[Alex Fontana]

Is there any attribute that is unique to real user accounts only (mail enabled and non-mail enabled)?  We tried teaming up objectclass=user and givenname=*, but of course not all users have to have a given name.  Then tried teaming up the objectclass with useraccountcontrol=5*, then we found out about the 66048’s and 262656’s….damn them.  So, is there an ldap query that will give me all enabled active directory user accounts?  Most likely it’s so simple I would never have even thought about it.   TIA Alex.