LDAP Query for specific OU

We have an externally hosted Email Security system from Postini for Anti-Spam which allows us to push up configuration information from our AD.  

I want the initial search to be done at the Root Level of the AD tree but only want results from  a sub-OU.

Is there any way to craft an LDAP query to do this?
I.E.  When looking at the attached ADSearch.png screen shot:
Search Base = OU=AD-ROOT
BUT only show users and email addresses from OU=AD-NYC
Who is Participating?
Chris DentPowerShell DeveloperCommented:

A bit of a short answer I'm afraid: No.

LDAP Queries cannot target a specific OU within the query, that can only be done by setting the search base for the query.

There are two reasons for this. First an objects parent isn't an attribute within the object (so a users OU isn't an attribute you can query), and second, you cannot construct queries using partial distinguished names (meaning you cannot do (distinguishedName=*OU=AD-NYC ...)).

There are of ways to work around this problem, including populating a specific attribute on the account, either with their parent OU name, or another pre-determined value. Or create a group that contains each of the users within the OU as a member and use that when making a query.

If you would like to investigate either of those options, and want to help putting automated processes in place for it don't hesitate to ask, I'm sure we can help with that.

mcarpenter1971Author Commented:
Thanks.... That was pretty much what I was thinking.  I was told you should be able to do it but I was skeptical.  
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.