LDAP not returning contents (users) in a container (group) from AD

[Paul Coleman]

Hey..

Background, I'm a vendor for a larger company. my client is one
facility on this larger domain. My point of contact in the networking
department is not familiar with LDAP at all, but has other vendors
doing a similar query, and has assured me that my account, and
permissions are setup the same.

Now I need to obtain users from one group on the domain, and place them
in another database. My query works on my small domain with no
problems, but on this large domain, it just will not give me any
results.

I have a simple LDAP query that queries one group that I have access
too, on a very large domain.

The Base for the Group I am querying:
CN=ProductUserGroup,OU=Groups,DC=Facility,DC=company,DC=com

My full string:
<LDAP://CN=ProductUserGroup,OU=Groups,DC=Facility,DC=company,DC=com">;(objectCategory=User);Name,samAccountName;Subtree"

Now running this yeilds no records, and I've been assured that there
are currently 5 users in this group. Now I don't think its a query
problem, but I am looking for information that I can point my client
too and help establish where the problem lies.

Things I have tried:
I've had the client run the LDAP script to populate our database, with
supposedly administrative rights on the Facility.company.com domain,
and it still did not yield any records.

So I'm hoping someone out there may know what is missing from my domain
vendor account, or what setting needs to be modified in order for this
query to actualy return some data. Or perhaps my query is just all
wrong.

thanks in advance...

-Paul

 

[Joe Richards [MVP]]

If the base DN is a group, then your query is wrong. You are asking for
users (incorrectly) and if the object is a group, you would never get an
object back.

The membership of a group is an attribute called member on the group object.

Try this (all one line)

adfind -b CN=ProductUserGroup,OU=Groups,DC=Facility,DC=company,DC=com member

--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm