We help IT Professionals succeed at work.

ldap search filter for two groups

Medium Priority
9,356 Views
Last Modified: 2012-05-11
i have two groups in AD that i need to create a search filter for.

i know how to create a search filter for one group, but not two in the same filter.

this is the search filter for group eng2:
(&(objectclass=group)(memberOf=CN=eng2,CN=Users,DC=contoso,DC=com))

i need to search for groups eng2 AND chem1

how do i search for both in the same search filter?
i've already read over this article:  http://msdn.microsoft.com/en-us/library/aa746475(v=vs.85).aspx

thanks!
Comment
Watch Question

Steven CarnahanAssistant Vice President\Network Manager
CERTIFIED EXPERT

Commented:
I think what you are looking for would be:

(&(objectclass=group)(memberOf=(CN=eng2)(CN=chem1),CN=Users,DC=contoso,DC=com))



CERTIFIED EXPERT
Top Expert 2013

Commented:
You just add the other group to your filter so the same thing

(&(objectcategory=group)(memberof=DN= group 1)(memberof=DN=group 2))

I did something similar here  http://adisfun.blogspot.com/2009/06/find-users-who-are-not-in-specific.html

In my case I was looking for not a member of multiple groups  hence the exclamation point for not !

Thanks

Mike

Author

Commented:
still having problems with this.

the following works fine:
(&(objectclass=user)(memberOf=CN=eng2,OU=Groups,DC=contoso,DC=com))

this does not work:
(&(objectclass=user)(memberOf=CN=eng2)(memberOf=CN=chem1),OU=Groups,DC=contoso,DC=com))

also tried this:
(&(objectclass=user)(memberOf=(CN=chem1)(CN=eng2),OU=Groups,DC=contoso,DC=com))


any ideas?  i know i'm close!
CERTIFIED EXPERT
Top Expert 2013

Commented:
are you trying to find a user that is a member of both groups?

Author

Commented:
users contained within both
CERTIFIED EXPERT
Top Expert 2013

Commented:
(&(objectcategory=person)(objectclass=user)(memberof=CN=eng2,OU=Groups,DC=contoso,DC=com)(memberof=CN=chem1,OU=Groups,DC=contoso,DC=com))

Thanks

Mike

Author

Commented:
still no dice

let's try again.....

i have two groups containing users.  these groups are eng2 and chem1.

when i try the suggested queries above, no results are returned BUT when i try to query only one or the other group, users ARE returned.  for example, each of the following queries return users:

(&(objectclass=user)(memberOf=CN=chem1,OU=Groups,DC=contoso,DC=com))

(&(objectclass=user)(memberOf=CN=eng2,OU=Groups,DC=contoso,DC=com))


i need to combine these two queries.  hopefully that makes sense.  thanks again for everyone's help!
CERTIFIED EXPERT
Top Expert 2013

Commented:
I'm not sure why it is not working.  So I created two groups  eng1 and chem1  look at  my query/screenshots

Thanks

Mike


mutiplegroups1.png
mutiplegroups2.png

Author

Commented:
man your screenshots look legit....

what if you made a separate test account for each group
run the query, will it return BOTH test accounts?
CERTIFIED EXPERT
Top Expert 2013

Commented:
no, it will only list the user that is in both groups,  so I just created two new uers put one in chem1 put one in eng1

...so test users is only returned...see screen shots

Thanks

Mike
chem1.png
eng1.png
groupspart2a.png

Author

Commented:
but i want to return test2 and test3 users

i don't want to return the common user - maybe that's where my explanation went wrong?  is what i'm asking possible?
CERTIFIED EXPERT
Top Expert 2013

Commented:
test2 and test2 are not in both groups, do you want users that are in either group

Author

Commented:
i want the query to return all users found in either group

so if there are 10 users in chem1 and 10 users in eng1 > all unique users btw, then 20 users will be returned with the query.
CERTIFIED EXPERT
Top Expert 2013
Commented:
Unlock this solution and get a sample of our free trial.
(No credit card required)
UNLOCK SOLUTION

Author

Commented:
great, i will give this a shot while on-site tomorrow!!!!  thanks for your help, you've been awesome!

one last question, is objectcategory=person necessary?  i've always stuck to objectclass=user, never had to include objectcategory in my syntax.
CERTIFIED EXPERT
Top Expert 2013

Commented:
No problem, glad to help out

objectclass=user will also return computers (just search for objectclass=user yourself).  Great overview here http://www.activedir.org/Articles/tabid/54/articleType/ArticleView/articleId/28/Default.aspx

 I'm going to steal...and steal from someone that I consider the "Michael Jordan/Lebron James of the AD World"  (especially outside of Microsoft).

Joe Richards http://www.joeware.net/index2.htm

Yes this is not for your exact situation I went over that but this is still a great learning opportunity.

I've saved this comment for years and refer to it often:

*****from Joe**********

Second, __in general__ when you are going after users you actually want to change (objectCategory=user) to (objectCategory=person)(objectclass=user) or sAMAccountType=805306368.
 
The user class is not an objectcategory, it is only an objectclass. When you specify (objectCategory=user) the system looks up the defaultObjectCategory of user and finds person. So (objectCategory=user) becomes (objectCategory=person) which means depending on the rest of the query it will be looking at all user and contact objects. If you have no contact objects, this works itself out, however if you have lots of contacts, you will feel the pinch in perf as the query looks over objects it doesn't need to.

*************

Thanks

Mike
CERTIFIED EXPERT
Top Expert 2013

Commented:
Follow up, Joe also had a great blog entry

http://blog.joeware.net/2007/03/24/831/

...and I was the first comment over four years ago :)


Thanks

Mike

Author

Commented:
thanks!
Unlock the solution to this question.
Thanks for using Experts Exchange.

Please provide your email to receive a sample view!

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.