Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have not much knowledge about AD. We are a global company with a number of different AD domains with replication etc. going on.

I have two user accounts. Beside account name, real name etc. there is no difference between the accounts. Same Group Memberships (both in Domain Users for example) etc.

But when I make a ldap search on the Domain Controller, one user account is only shown with the CN but without any data, while the other is shown normally:

# John Doe, Employees, Someplace, my.do.main
dn: CN=John Doe,OU=Employees,OU=Someplace, DC=my,DC=do, DC=main

# Jane Doe, Employees, Someplace, my.do.main
dn: CN=Jane Doe,OU=Employees,OU=Someplace, DC=my,DC=do, DC=main
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Jane Doe
mail: jane.doe@my.do.main


The first account is shown totally empty. This is only happening for this one account and I just can't figure out why.

share|improve this question
Permissions. I assume you have rights to read the data on the Jane Doe object but not the John Doe object? –  geoffc Feb 3 '11 at 21:10
Thanks for the hint. The data is only missing when doing an anonymous bind. But for all other accounts this suffices. How is this configured? Thanks. –  Johannes Eichner Feb 3 '11 at 22:12
I found this webpage which explained how to fix it and I have now done so: petri.co.il/anonymous_ldap_operations_in_windows_2003_ad.htm –  Johannes Eichner Feb 3 '11 at 22:50
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.