[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

ldap search filter for two groups

Posted on 2011-04-25
18
Medium Priority
?
4,068 Views
Last Modified: 2012-05-11
i have two groups in AD that i need to create a search filter for.

i know how to create a search filter for one group, but not two in the same filter.

this is the search filter for group eng2:
(&(objectclass=group)(memberOf=CN=eng2,CN=Users,DC=contoso,DC=com))

i need to search for groups eng2 AND chem1

how do i search for both in the same search filter?
i've already read over this article:  http://msdn.microsoft.com/en-us/library/aa746475(v=vs.85).aspx

thanks!
0
Comment
Question by:sknoll84
  • 9
  • 8
18 Comments
 
LVL 26

Expert Comment

by:pony10us
ID: 35463446
I think what you are looking for would be:

(&(objectclass=group)(memberOf=(CN=eng2)(CN=chem1),CN=Users,DC=contoso,DC=com))



0
 
LVL 57

Expert Comment

by:Mike Kline
ID: 35463463
You just add the other group to your filter so the same thing

(&(objectcategory=group)(memberof=DN= group 1)(memberof=DN=group 2))

I did something similar here  http://adisfun.blogspot.com/2009/06/find-users-who-are-not-in-specific.html

In my case I was looking for not a member of multiple groups  hence the exclamation point for not !

Thanks

Mike
0
 

Author Comment

by:sknoll84
ID: 35474753
still having problems with this.

the following works fine:
(&(objectclass=user)(memberOf=CN=eng2,OU=Groups,DC=contoso,DC=com))

this does not work:
(&(objectclass=user)(memberOf=CN=eng2)(memberOf=CN=chem1),OU=Groups,DC=contoso,DC=com))

also tried this:
(&(objectclass=user)(memberOf=(CN=chem1)(CN=eng2),OU=Groups,DC=contoso,DC=com))


any ideas?  i know i'm close!
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
LVL 57

Expert Comment

by:Mike Kline
ID: 35474768
are you trying to find a user that is a member of both groups?
0
 

Author Comment

by:sknoll84
ID: 35474899
users contained within both
0
 
LVL 57

Expert Comment

by:Mike Kline
ID: 35474919
(&(objectcategory=person)(objectclass=user)(memberof=CN=eng2,OU=Groups,DC=contoso,DC=com)(memberof=CN=chem1,OU=Groups,DC=contoso,DC=com))

Thanks

Mike
0
 

Author Comment

by:sknoll84
ID: 35480428
still no dice

let's try again.....

i have two groups containing users.  these groups are eng2 and chem1.

when i try the suggested queries above, no results are returned BUT when i try to query only one or the other group, users ARE returned.  for example, each of the following queries return users:

(&(objectclass=user)(memberOf=CN=chem1,OU=Groups,DC=contoso,DC=com))

(&(objectclass=user)(memberOf=CN=eng2,OU=Groups,DC=contoso,DC=com))


i need to combine these two queries.  hopefully that makes sense.  thanks again for everyone's help!
0
 
LVL 57

Expert Comment

by:Mike Kline
ID: 35480548
I'm not sure why it is not working.  So I created two groups  eng1 and chem1  look at  my query/screenshots

Thanks

Mike


mutiplegroups1.png
mutiplegroups2.png
0
 

Author Comment

by:sknoll84
ID: 35480597
man your screenshots look legit....

what if you made a separate test account for each group
run the query, will it return BOTH test accounts?
0
 
LVL 57

Expert Comment

by:Mike Kline
ID: 35480655
no, it will only list the user that is in both groups,  so I just created two new uers put one in chem1 put one in eng1

...so test users is only returned...see screen shots

Thanks

Mike
chem1.png
eng1.png
groupspart2a.png
0
 

Author Comment

by:sknoll84
ID: 35480702
but i want to return test2 and test3 users

i don't want to return the common user - maybe that's where my explanation went wrong?  is what i'm asking possible?
0
 
LVL 57

Expert Comment

by:Mike Kline
ID: 35480712
test2 and test2 are not in both groups, do you want users that are in either group
0
 

Author Comment

by:sknoll84
ID: 35480728
i want the query to return all users found in either group

so if there are 10 users in chem1 and 10 users in eng1 > all unique users btw, then 20 users will be returned with the query.
0
 
LVL 57

Accepted Solution

by:
Mike Kline earned 2000 total points
ID: 35480742
ahhh ok, so then you need to combine the or which is the "pipe" |

check the screenshot

Thanks

Mike


member-of-either-group.png
0
 

Author Comment

by:sknoll84
ID: 35480764
great, i will give this a shot while on-site tomorrow!!!!  thanks for your help, you've been awesome!

one last question, is objectcategory=person necessary?  i've always stuck to objectclass=user, never had to include objectcategory in my syntax.
0
 
LVL 57

Expert Comment

by:Mike Kline
ID: 35480998
No problem, glad to help out

objectclass=user will also return computers (just search for objectclass=user yourself).  Great overview here http://www.activedir.org/Articles/tabid/54/articleType/ArticleView/articleId/28/Default.aspx

 I'm going to steal...and steal from someone that I consider the "Michael Jordan/Lebron James of the AD World"  (especially outside of Microsoft).

Joe Richards http://www.joeware.net/index2.htm

Yes this is not for your exact situation I went over that but this is still a great learning opportunity.

I've saved this comment for years and refer to it often:

*****from Joe**********

Second, __in general__ when you are going after users you actually want to change (objectCategory=user) to (objectCategory=person)(objectclass=user) or sAMAccountType=805306368.
 
The user class is not an objectcategory, it is only an objectclass. When you specify (objectCategory=user) the system looks up the defaultObjectCategory of user and finds person. So (objectCategory=user) becomes (objectCategory=person) which means depending on the rest of the query it will be looking at all user and contact objects. If you have no contact objects, this works itself out, however if you have lots of contacts, you will feel the pinch in perf as the query looks over objects it doesn't need to.

*************

Thanks

Mike
0
 
LVL 57

Expert Comment

by:Mike Kline
ID: 35480999
Follow up, Joe also had a great blog entry

http://blog.joeware.net/2007/03/24/831/

...and I was the first comment over four years ago :)


Thanks

Mike
0
 

Author Closing Comment

by:sknoll84
ID: 35728220
thanks!
0

Featured Post

Get quick recovery of individual SharePoint items

Free tool – Veeam Explorer for Microsoft SharePoint, enables fast, easy restores of SharePoint sites, documents, libraries and lists — all with no agents to manage and no additional licenses to buy.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A bad practice commonly found during an account life cycle is to set its password to an initial, insecure password. The Password Reset Tool was developed to make the password reset process easier and more secure.
Your business may be under attack from a silent enemy that is hard to detect. It works stealthily in the shadows to access and exploit your critical business information, sensitive confidential data and intellectual property, for commercial gain. T…
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…
Suggested Courses

831 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question