Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Following up on my last question, once I have the correct domain controller, I would like to fetch a given user's exchange server. I am able to get this far using ldapsearch:

ldapsearch -LLL -h -D -W -b "DC=example,DC=com"-s sub -x '(sAMAccountName=someuser)' msExchHomeServerName homeMTA homeMDB

dn: CN=someuser,OU=Employees,OU=Users,DC=example,DC=com
homeMTA: CN=Microsoft MTA,CN=EXCHANGESERVER,CN=Servers,CN=First Administrative Gr
 oup,CN=Administrative Groups,CN=My Company,CN=Microsoft Exchange,CN=Servic
homeMDB: CN=Database 1,CN=Storage Group 1,CN=InformationStore,CN=EXCHANGESERVER,C
 N=Servers,CN=First Administrative Group,CN=Administrative Groups,CN=My Company,
 CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=example,DC=com
msExchHomeServerName: /o=My Company/ou=First Administrative Group/cn=Config

I'd like to convert the DNs above (in their two completely different formats) into DNS names. In this case, they should all be translated into

Alternately, is there an easier way to get to this information? In my most common case, the user making the query is the user we're interested in, so my ideal is a way a unix user can ask "what is my exchange server's FQDN?" without requiring the unix machine to be joined to the AD domain.

EDIT: I thought I'd found a solution, but it doesn't actually work:

ldapsearch -x -LLL -h -D -W -s base -b "CN=Microsoft MTA,CN=EXCHANGESERVER,CN=Servers,CN=First Administrative Group,CN=Administrative Groups,CN=My Company,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=example,DC=com" dnsHostName

This is very close, but you have to know to strip the "CN=Microsoft MTA," off the front of the -b property, which doesn't lend itself to programatic work.

share|improve this question
up vote 3 down vote accepted

Assuming you can read VBScript, here's a link to a script from Microsoft showing how to find the location of a mailbox for a user account.

The script is querying the "homeMDB" attribute of the user (to get the DN of the the mailbox database holding the user's mailbox). Then, they're querying that MDB to find the DN of the server object that "owns" the MDB, using the value of the the "msExchOwningServer" attribute of the MDB (BTW, you can ignore the bits about the storage group, because you don't care about that).

Assuming you want a DNS name, query the "networkAddress" property of the server object (the one named in the "msExchOwningServer" attribute of the MDB object returned by querying the DN of the user's "homeMDB"), and take the value starting with "nacn_ip_tcp". That'll give you the FQDN of the server hosting that MDB.


I didn't mean to imply that you needed to execute the VBScript-- just that it would tell you what to query with ldapsearch. Likewise, when I said "server object", I didn't mean to imply that you would be instantiating some kind of VBScript object-- only that you would query the DN named for the server.

So, assuming I want the DNS name of the server hosting the mailbox for user Bob, I'd query with the LDAP search filter "(sAMAccountName=Bob)" at the root of the domain (or root of the global catalog, if I wanted to search all domains in the forest) for Bob's "homeMDB" attribute.

ldapsearch -h -D -W -b "DC=ad,DC=example,DC=com" -s sub -x "(sAMAccountName=Bob)" homeMDB

This returns the homeMDB attribute:

homeMDB: CN=Mailbox Store (EXCH-SRV),CN=First Storage Group,CN=InformationStore,CN=EXCH-SRV,CN=Servers,CN=EXAMPLE,CN=Administrative Groups,CN=Example Organization,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=ad,DC=example,DC=com

Then, using that homeMDB attribute as a base DN, query for "msExchOwningServer":

ldapsearch -h -D  -W -b "CN=Mailbox Store (EXCH-SRV),CN=First Storage Group,CN=InformationStore,CN=EXCH-SRV,CN=Servers,CN=EXAMPLE,CN=Administrative Groups,CN=Example Organization,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=ad,DC=example,DC=com" msExchOwningServer

This returns the DN of the server hosting that mailbox database:

msExchOwningServer: CN=EXCH-SRV,CN=Servers,CN=EXAMPLE,CN=Administrative Groups,CN=Example Organization,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=ad,DC=example,DC=com

Finally, using the server's DN as the base DN, query for the "networkAddress" attribute:

ldapsearch -h -D -W -b "CN=EXCH-SRV,CN=Servers,CN=EXAMPLE,CN=Administrative Groups,CN=Example Organization,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=ad,DC=example,DC=com" networkAddress

This returns all the network addresses, of which you're interested in the one starting with "nacn_ip_tcp".

networkAddress: ncacn_vns_spp:EXCH-SRV
networkAddress: netbios:EXCH-SRV
networkAddress: ncacn_np:EXCH-SRV
networkAddress: ncacn_spx:EXCH-SRV
networkAddress: ncalrpc:EXCH-SRV

You can do the same thing for the "homeMTA" attribute, but you'll search for "msExchResponsibleMTAServerBL" instead of "msExchOwningServer" when querying the DN named in the "homeMTA" attribute.

Finally, if you want to forego all of that, query the user for the "msExchHomeServerName" attribute.

msExchHomeServerName: /o=Example Organization/ou=EXAMPLE/cn=Configuration/cn=Servers/cn=EXCH-SRV

Take the value returned there and use that as the serach filter on the "legacyExchangeDN" attribute and search the Exchange-related subtree of the directory for the "networkAddress" attribute.

ldapsearch -h -D -W -b "CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=ad,dc=example,dc=com" -x "(legacyExchangeDN=/o=Example Organization/ou=EXAMPLE/cn=Configuration/cn=Servers/cn=EXCH-SRV)" networkAddress

And you'll get back the same network addresses as above.

share|improve this answer
I can read it, but I can't execute VB on Unix, or get ahold of the server object in question there. :D Looking at this, I'm suspecting that "msExchOwningServer" is a fancy way of saying "the CN immediately prior to CN=Servers." Am I reading it right, or is there actually something deeper? Is there a spec that defines how MS lays out this DN such that I can rely on its order? The closest I find to specs on these DNs read "the DN will be similar to..." which is much more squishy than what I want (i.e. "the DN is made up of the following components....") – Rob Napier Oct 26 '09 at 1:57
I dropped on an edit clarifying. – Evan Anderson Oct 26 '09 at 15:34
Thanks for the additional information. The problem I'm seeing is in the search for "CN=Mailbox Store (EXCH-SRV)..." AD cannot find this DN and returns that the closest match is "CN=EXCH-SRV,CN=Servers,...", which is correct, but an awkward intermediary step (parsing out the error and resubmitting). I can string-munge it, but that seems fragile and requires special casing in my code that also talks to OpenLDAP servers. – Rob Napier Oct 28 '09 at 15:56
I don't know what to tell you. I'm having no problems querying the DN returned for the "homeMDB" attribute as the base DN for a query returning the "msExchOwningServer" attribute from the base DN. I'm not having to "string munge" anything. Using the "msExhcHomeServerName" and filtering your next query on the "legacyExchangeDN" attribute will get to your result one query faster, but it'll get you to the same place. – Evan Anderson Oct 28 '09 at 17:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.