How to get all groups of members who distinguishedName begins with something

Question

My requirement is to get all the groups of users whose distinguishedName begins with say Auser*.

So, I created a filter in Apache Directory Studio

(&
    (objectClass=group)
    (member=CN=Auser*)
)

However, to my surprise, this does not return any results. If I change this to a particular user's distinguishedName, I am able to get results

(&
    (objectClass=group)
    (member=CN=AUser10,OU=Mygrp,DC=domain,DC=com)
)

Am I missing something ?

score 1 · Answer 1 · answered Jan 23 '17 at 14:07

1

member has Distinguished-Name-Syntax, and given it's Active Directory you are trying to search, you can't have substring matching as in a normal Directory-String attribute like cn.

Why don't you just reverse your search strategy? Do a subtree search on your domain with filter (&(objectClass=user)(cn=userprefix*)) retrieving attribute memberOf, export to CSV, remove duplicates, done.

answered Jan 23 '17 at 14:07

marabu

1,166
7
9

`memberOf` attribute does not store all the groups of a user (like Domain local aren't stored in `memberOf`). Hence I am querying on groups and not on user – SimpleGuy Jan 24 '17 at 04:25
Use memberOf for what it's worth. Export the domain local groups and use grep / findstr. – marabu Jan 24 '17 at 09:52
Yes tht is what I am doing... but wanted a better direct way – SimpleGuy Jan 24 '17 at 11:46

Mostafa · Answer 2 · 2017-01-23T08:50:15.477

0

Please try this one :

(&
    (objectCategory=group)
    (name=Auser*)
)

distinguished name is long name containing full path + name. like : CN=Username,OU=internalFolder,OU=parentFolder,DC=domainComponentName,DC=com

For filtering by name just search on the name or other attributes you want like givenName

edited Jan 23 '17 at 08:50

answered Jan 23 '17 at 08:44

Mostafa

3,002
10
52
79

How to get all groups of members who distinguishedName begins with something

2 Answers2