Tags:Microsoft, Windows Server 2003 R2, Active Directory
Hello, glad for any help on this:
I want to query for users who are NOT a member of a particular group. However the query does not display the expected result:
I created a new query on "Users, Contacts and Groups", and on the Advanced tab I selected FIELD: User->Member Of, CONDITION: either "Is (exactly)" or "Is not" VALUE: "CN=UNI Deny external Email,OU=Distribution_Lists,OU=_Our_Groups,DC=intranet,DC=ourdomain,DC=net"
QUERY ROOT: ...\intranet
I tried the value with and without full path and w/ and w/o quotation marks. If condition is "Is (exactly)", no results are displayed, if condition is "Is not", all users are displayed
This is what the query string looks like that is created by the GUI: (&(&(|(&(objectCategory=person)(objectSid=*)(!samAccountType:1.2.840.113556.1.4.804:=3))(&(objectCategory=person)(!objectSid=*))(&(objectCategory=group)(groupType:1.2.840.113556.1.4.804:=14)))(objectCategory=user)(!memberOf="CN=UNI Deny external Email,OU=Distribution_Lists,OU=_Our_Groups,DC=intranet,DC=ourdomain,DC=net")))
The group definitely has members.
I have found similar threads on Experts-Exchange, but no joy. As I am not familiar with VBScript, this is not an option for me.
Thanks for your help
By the way, I am a beginner with regards to LDAP queries, not sure whether I am missing something basic. A query on workstations that I created works, though :-)
You're going to need to script this, full stop. An LDAP memberOf query is not going to chase nested memberships, such as where a user is a member of a group which is a member of the group you're looking for. The functionality simply isn't there.
Use one of the VBScript samples that have been pre-written for your use here: http://www.rlmueller.net/freecode1.htm (I usually go with #6.) Each example returns a TRUE if a user is a member of a group, or FALSE if they are not.
If you're willing to make the operational assumption that you will never need to query for nested memberships (I wouldn't, but that's me), the appropriate query would be as follows: (all one line, text will wrap.)
Well, if I ever need to query for nested memberships, I can still look into the scripting option.
For now, I only need to know which users are not in that particular group, and unfortunately your query string does not give me any result either. The result list is empty, also if I remove the ! (NOT).
I am sure this is some basic mistake I am making. I have tried other groups too, they cannot be queried either.
