How to write LDAP query for users not in a specific group

I'm trying to write a LDAP query for users NOT in any group starting with a particular word.  For example, I'd like to see all users who are not in a group that starts with the word Travel.

I would like to use LDAP query within Active Directory or a separate VB Script.
Who is Participating?
Chris DentConnect With a Mentor PowerShell DeveloperCommented:

Yes, and not quite :)

You would use either AND (&) or OR (|). e.g.

AND: (&(objectCategory=user)(&(!memberOf=CN=Travel,OU=Test,DC=test,DC=local)(!memberOf=CN=Group2,OU=Test,DC=test,DC=local)))

Translates to: Object is a User AND is NOT in Travel AND is NOT in Group2

OR: (&(objectCategory=user)(|(!memberOf=CN=Travel,OU=Test,DC=test,DC=local)(!memberOf=CN=Group2,OU=Test,DC=test,DC=local)))

Translates to: Object is a User AND is NOT in Travel OR is NOT in Group2

AD Users and Computers has a maximum length for query so if your group paths are long you might run into that.

If you're not too familiar with LDAP queries I find it best to break them down like this:


Statements at the same level are evaluated together, each level will return True or False, always start with the highest level (in this case, the two memberOf expressions).

If that makes any sense at all ;)

Toni UranjekConsultant/TrainerCommented:

Try to create the follwing custom query in Active Directory User and Computers:

Substitute "CN=Travel,OU=Test,DC=test,DC=local" with proper LDAP distinguished name for your group.


Chris DentPowerShell DeveloperCommented:

You can't use wildcards for group names when searching member or memberOf. That makes "any group starting with a particular word" impossible within the context of an LDAP query I'm afraid. That kind of check would have to be done in code, performed against a data set returned from a query against AD.

The nearest you'll get is a query for "not a member" of a specific group as Toni has demonstrated above.

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

TravelSmithAuthor Commented:
Can I list multiple groups?  If so how should it be separated in the code?  (semicolon?)
TravelSmithAuthor Commented:
The AND query works great!  Thank you so much!!
TravelSmithAuthor Commented:
Great Work!
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.