• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1070
  • Last Modified:

LDAP Query for specific OU

We have an externally hosted Email Security system from Postini for Anti-Spam which allows us to push up configuration information from our AD.  

I want the initial search to be done at the Root Level of the AD tree but only want results from  a sub-OU.

Is there any way to craft an LDAP query to do this?
I.E.  When looking at the attached ADSearch.png screen shot:
Search Base = OU=AD-ROOT
BUT only show users and email addresses from OU=AD-NYC
1 Solution
Chris DentPowerShell DeveloperCommented:

A bit of a short answer I'm afraid: No.

LDAP Queries cannot target a specific OU within the query, that can only be done by setting the search base for the query.

There are two reasons for this. First an objects parent isn't an attribute within the object (so a users OU isn't an attribute you can query), and second, you cannot construct queries using partial distinguished names (meaning you cannot do (distinguishedName=*OU=AD-NYC ...)).

There are of ways to work around this problem, including populating a specific attribute on the account, either with their parent OU name, or another pre-determined value. Or create a group that contains each of the users within the OU as a member and use that when making a query.

If you would like to investigate either of those options, and want to help putting automated processes in place for it don't hesitate to ask, I'm sure we can help with that.

mcarpenter1971Author Commented:
Thanks.... That was pretty much what I was thinking.  I was told you should be able to do it but I was skeptical.  

Featured Post

Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now