Active Directory search - filter by Manager

Question

I'm trying to get a list of users from the Active Directory, who have a specified manager. I used the following LDAP filter without success:

(manager=CN=Misterboss_n*)

However, it returns no result. Users have the following value in the manager attribute:

"CN=Misterboss_n,OU=xyz user,DC=xyz,DC=local"

What am I doing wrong? If I replace the above filter with something like this:

(givenName=John*)

it works okay (returns all users whose given name is John).

Wider context:

public List<ADUserDetail> GetAllEmployeesUnderMisterboss()
        {
            List<ADUserDetail> userlist = new List<ADUserDetail>();
            string filter = "";
            _directoryEntry = null;
            DirectorySearcher directorySearch = new DirectorySearcher(SearchRoot);
            directorySearch.Asynchronous = true;
            directorySearch.CacheResults = true;
            filter = "(manager=CN=Misterboss_n*)";
            directorySearch.Filter = filter;
            SearchResultCollection userCollection = directorySearch.FindAll();
            foreach (SearchResult users in userCollection)
            {
                DirectoryEntry userEntry = new DirectoryEntry(users.Path, LDAPUser, LDAPPassword);
                ADUserDetail userInfo = ADUserDetail.GetUser(userEntry);
                userlist.Add(userInfo);
            }
            return userlist;
        }

Thanks for the help!

Answer 1

I don't think there is a start-of-field search available for DN-typed properties. You will have to use the full DN of the manager. If you don't know the full DN, find the manager's LDAP object first and use its distinguishedName property.

Be sure to escape the DN value properly before building your filter - not every character that is valid in a DN is also valid in an LDAP filter expression:

*   as  \2a
(   as  \28
)   as  \29
\   as  \5c
NUL as  \00
/   as  \2f

For code samples, see this related thread where I answered a very similar question: Getting all direct Reports from Active Directory