LDAP Query Language against AD

[pcstru]

I'm using the MS Active Directory Users and Computers Management Console, using find, selecting custom search and then clicking on teh advanced tab to run queries. Simple queries, (objectClass=person) work fine. I'm trying to build a query which lists the members of a group, it should be :

 

(&(objectClass=person)(memberOf=CN=,OU=,DC=,DC=org,DC=uk))

 

But it doesn't work. Infact, even

 

(ObjectClass=person, OU=Users,DC=,DC=org,DC=uk)

 

Doesn't work. I need to know what stupid I am doing!

[mavhc]

I use

 

(&(objectCategory=person)(ObjectClass=user)(memberof=CN=groupname,OU=Groups,DC=school,DC=local)(!(userAccountControl:1.2.840.113556.1.4.803:=2))

 

for enabled users in a group groupname in an ou Groups in a domain school.local, so remove the last part for all users

 

(&(objectCategory=person)(ObjectClass=user)(memberof=CN=groupname,OU=Groups,DC=school,DC=local))

[pcstru]

Thankyou. That's helpful.

[pcstru]

Where I seem to be struggling is where the group lives in a container or OU other than the root I'm searching from. So we have something like

 

School.Local->Users

School.Local->Teachers

School.Local->Students

 

The group "Domain Users" lives in the container Users, but the people I want listed will be in Teachers or Students. So

 

(&(objectCategory=person)(ObjectClass=user)(memberof=CN=Domain Users,CN=Users,DC=))

 

will list people/users in the container Users, but

 

(&(objectCategory=person)(ObjectClass=user)(memberof=CN=Domain Users,OU=Teachers,DC=))

 

Returns no results. Does that make sense to anyone? If so, any thoughts?

[Hedghog]

I think if your domain name inclues the .local suffix there should be an entry for DC=local

[pcstru]

The domain is something.org.uk , so where I have written DC= the actual content expands to DC=something,DC=org,DC=uk

[mavhc]

Don't confuse OUs and Groups, you're wanting to restrict the search to within an OU?

[pcstru]

Don't confuse OUs and Groups, you're wanting to restrict the search to within an OU?

 

I want the search to run across all OU's in the domain, regardless of what OU the group is in. The solution seems to be to make sure the group itself is at the root of the domain organisational structure.