LDAP query to return list of sub-OUs?

Is it possible to use an LDAP query to return the list of 2nd level OU's within "Alphabet" below? If so, what would that query look like?

   |- OU=A
         |- OU=Green
   |- OU=B
   |- OU=C
         |- OU=Yellow
   |- OU=D
   |- OU=Five

So I would just want a list of A, B, C, D returned by the query. The LDAP source is Active Directory 2003. I'm only after the names of the OU's, not anything inside of or below them.
LVL 16
Who is Participating?

Improve company productivity with a Business Account.Sign Up

Chris DentConnect With a Mentor PowerShell DeveloperCommented:

Afraid not, you can have a filter return OUs ("(objectClass=organizationalUnit)"), and OUs with specific names ("(&(objectClass=organizationalUnit)(name=A))"), but only second level, or a range of names is a bit beyond Ldap Filters.

It could be scripted pretty easily if you need to.

jessc7Author Commented:
In effect, what would the script do? Would a script see the returned OU's as arrays, and be able to easily determine the '2nd level' OU's that way?
Chris DentConnect With a Mentor PowerShell DeveloperCommented:

That would be a reasonable enough approach.

I like PowerShell, so I'd probably do...

Get-QADObject -LdapFilter "(objectClass=organizationalUnit)" | ?{ $_.DN.Split(",").Count -eq 4 }

Where 4 is made up of 2 elements of OU names, and 2 elements of domain name. It would find:


But not FirstLevel or ThirdLevel.

Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

jessc7Author Commented:
I'm still new on Powershell. Would your example return only one OU, or would it return all at the second level? So back to my original scenario I would be looking to dynamically return a list of:


And ultimately I am wanting to get at the values of A, B, C, D.
Chris DentConnect With a Mentor PowerShell DeveloperCommented:
It would return all of those as an array of objects. You might tag Select-Object onto the end like this:

Get-QADObject -LdapFilter "(objectClass=organizationalUnit)" | `
  ?{ $_.DN.Split(",").Count -eq 4 } | `
  Select-Object Name, DN

Which would give you the simple OU name as well as the DN as you have it above.

Get-QADObject is part of Quest's CmdLet set which can be downloaded here:


There's more available than shown with the select, if you wanted to see the full list of properties available for each OU you could run:

Get-QADObject -LdapFilter "(objectClass=organizationalUnit)" | `
  ?{ $_.DN.Split(",").Count -eq 4 } | `
  Format-List *

jessc7Author Commented:
Thanks for the feedback, and scripting example for an alternative
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.