Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We're using WSFTP, which has an Active Directory Integration module. To populate the user accounts you need to provide a connection string akin to:

  • OU=Users,DC=domain,DC=com
  • CN=Domain Users,OU=Users,DC=domain,DC=com


  • Is there a Tool/Program/Script/Formula that allows me to decipher how these strings might look based on what I can see in Active Directory Users & Computers?
  • Is there a proper/accepted name for these types of connection strings? I don't even know what to Google to get more information about how to format one properly
  • How would I troubleshoot the connection string if I think it looks correctly formatted, but it isn't working?


share|improve this question
I figured out that the name for these types of connection strings is "Distinguished Name" or (DN) – I.T. Support Mar 11 '10 at 21:36
up vote 3 down vote accepted

Read up on LDAP:

Those are LDAP Distinguished names.

As to how they look in AD, lets take this simple structure:

|-- UserContainer
  |-- userA

the DN for this user would be: CN=userA,OU=UserContainer,dc=mydomain,dc=local (note I'm not using the default "users" container, that little bestie is a Microsoftism, and not a real container. In AD it's actually a CN (aka a leaf object, that magically has users in it instead of the container (OU) object it should be ... grrrr))

share|improve this answer
ADSIE.msc (run from server with adminpak.msi installed. It will show you the LDAP name of any object in active directory. Works Great! – I.T. Support Oct 1 '10 at 18:50

Tool to browse LDAP [link text][1]

[1]: [1]:"Softerra LDAP Browser"

share|improve this answer

On Windows 2003/2008 or workstation with RSAT you could use dsquery command. It gives you ldap path for object.

dsquery user -name USER_COMMON_NAME

USER_COMMON_NAME is not equal your user login, I don't remember, but probably it is equal description field from your Active Directory Users and Computers console.

Alternatively, you could use ldapsearch command from linux box (but first, you must configure openldap library in /etc/openldap/ldap.conf). I don't remember its syntax, but you must provide some account with password (Bind account) to bind to ldap from your Active Directory.

Here is link to article about LDAP in Windows

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.