Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

AD is at 2003 functional level, some of our DC's are running Windows Server 2003, some are 2008, some are 2008 R2.

When using the following query:

(objectCategory=user)

I do not expect to see any result where the objectCategory attribute is equal to 'CN=Person,CN=Schema,CN=Configuration,DC=Contoso'

I expect only objects where the objectCategory attribute is equal to 'CN=User,CN=Schema,CN=Configuration,DC=Contoso'

However, the query does indeed return all objects with the objectCategory attribute equal to 'CN=Person,CN=Schema,CN=Configuration,DC=Contoso'

My question then is this: Why do I see the search results that I do? Does AD actively translate queries that include (objectCategory=user) to (objectCategory=Person)? I have looked at the schema definitions for both the Person and the User class, but I cannot see any reason for the query results as I am experiencing them. I know that the User class is a subclass of the organizationalPerson class, which is a subclass of Person, but I can't see an attribute value that would explain this translation.

share|improve this question
    
Can you clarify what objects you're expecting to see, and what you are seeing instead? Having that objectCategory is not unexpected for a user account object. –  Shane Madden Mar 30 '12 at 16:38

2 Answers 2

up vote 0 down vote accepted

The reason you get the person objects is because there us no such category as User. User is a class. By strict definition Objectcategory takes a DN attribute. In order to avoid forcing coders to look up the schema DN, the query engine in AD allows you to provide a class and provides the defaultObjectCategory as the expansion. So if you were too look up the schema of User you get this as the defaultobjectcategory:

CN=Person,CN=Schema,CN=Configuration,DC=jimbdom,DC=com

The proper expression to search for users is: "(&(objectClass=user)(objectCategory=person))".

share|improve this answer
    
Perfect explanation! Thanks much, that explains away all my confusion on this issue. –  Joseph Alcorn Apr 2 '12 at 20:51

User inherits from Person. In other words, users are Persons. The opposite is not true.

So if you search for user, you can also see persons.

From Technet:

enter image description here

share|improve this answer
    
I was also hoping that by poinintg out the documentation you might read through it to discover the issue in your answer. The OP query is for a CATEGORY not a CLASS. –  Jim B Mar 30 '12 at 19:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.