Search code examples
active-directoryldapactivedirectorymembership

Get users "memberOf" AD-groups

I try to get all users "memberOf" all groups begining with "JE_"

I know that I cannot do the following:

memberOf=CN=JE*,OU=JE,OU=Gruppen,DC=subd,DC=dom,DC=net

But all the JE_* are located under a knot called "JE". Is it possible to get all users memberOf the groups located under the knot "JE"?

Solution

  • yes but you need to approach the problem differently. Rather than search against the user object you should search against teh group object with the user's DN.

    For example, consider the user

    cn=dave,OU=user,DC=subd,DC=dom,DC=net

    The user is a member of several JE* groups.

    CN=JE_1,OU=JE,OU=Gruppen,DC=subd,DC=dom,DC=net
CN=JE_2,OU=JE,OU=Gruppen,DC=subd,DC=dom,DC=net
CN=JE_3,OU=JE,OU=Gruppen,DC=subd,DC=dom,DC=net

    In order to find the JE* groups to which the user belongs search for groups with a base of OU=JE,OU=Gruppen,DC=subd,DC=dom,DC=net and a search filter of 

    (&(objectclass=group)(member=cn=dave,OU=user,DC=subd,DC=dom,DC=net))

    That will return all of the JE* group objects that contain the user in question. Ensure to specify that you only want the group name returned as an attribute otherwise all of the members will be returned too. Not a problem if there are only a handful but it might be a nuisance if there are thousands.