equalityMatch: filter item indicating equal match
<equalityMatch name="objectClass">
<value>user</value>
</equalityMatch>
substrings: filter item indicating substring match
<substrings name="cn">
<initial>John</initial>
</substrings>
greaterOrEqual: filter item indicating match if greater or equal
<greaterOrEqual name='roomnumber'>
<value>3000</value>
</greaterOrEqual>
lessOrEqual: filter item indicating match if less or equal
<lessOrEqual name='roomnumber'>
<value>2000</value>
</lessOrEqual>
present: filter item indicating presence of specified attribute
<present name="member">
</present>
approxMatch: filter item indicating approximate match
<approxMatch name='sn'>
<value>Smith<value>
</approxMatch>
extensibleMatch: filter item indicating extensible match (The below <extensibleMatch> element specifies a matching rule that is equivalent to the LDAP filter (groupType:1.2.840.113556.1.4.803:=2147483648) where 2147483648 is the decimal equivalent of the ADS_GROUP_TYPE_SECURITY_ENABLED flag (0x80000000).)
<extensibleMatch name="groupType" matchingRule="1.2.840.113556.1.4.803">
<value>2147483648</value>
</extensibleMatch>
isActive: filter item matching objects that are not disabled or not deprovisioned
<isActive xmlns="urn:oasis:names:tc:SPML:2:0:suspend"/>