On Error Resume Next

Set obj = GetObject("ldap://serverip/DC=xx, DC=xx")
WScript.Echo "A: " & obj.name

WScript.Echo "init script"

strUser = "TESTADAdministrador"
strPass = "test"
strDC = "serverip" ' this has to be FQDN of the DC
strAccount = "Administrador" 'Use the sAMAccountname (logon name)  value here instead of CN

Const ADS_SECURE_AUTHENTICATION = 0
Const ADS_SERVER_BIND = 389

Set objDSO = GetObject("LDAP:")
Set objRootDse = objDSO.OpenDSObject("LDAP://" & strDC & "/RootDSE", strUser, strPass, ADS_SECURE_AUTHENTICATION OR ADS_SERVER_BIND)
strTargetDncDomain = objRootDse.Get("defaultNamingContext")

strBase    = "<LDAP://" & strDC & "/" & strTargetDncDomain & ">;"

strAttrs = "cn=administrador,cn=Users,dc=xx, dc=xx"
strScope = "subtree"
strFilter = "(&(objectCategory=person)(objectClass=user)(sAMAccountname=" & strAccount & "));"

strQuery = strBase & strFilter & strAttrs & strScope

Set oConnection = CreateObject("ADODB.Connection")
oConnection.Provider = "ADsDSOObject"
oConnection.Properties("Encrypt Password") = True
oConnection.Open "Active Directory Provider", strUser, strPass

Set oCommand = CreateObject("ADODB.Command")
oCommand.ActiveConnection = oConnection
oCommand.CommandTimeout = 30

oCommand.CommandText = strQuery

Set objRS = oCommand.Execute
Do While Not objRS.EOF
   strDnFound = objRS.Fields("CN")
    wscript.echo "found it!"
    wscript.echo "query: " & strQuery
    wscript.echo strTargetDncDomain
   wscript.echo strDnFound ' Just so that we know it's working
   objRS.MoveNext
Loop

objRS.close
oConnection.close

cscript.exe //NoLogo "C:pathtoyour.vbs" >"C:output.txt"