Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two domain controllers configured with non-contiguous namespaces. There is a two-way forest trust and crossRef objects set up between domains. I can successfully execute an LDAP search for any particular object in either domain. However, I would like to be able to execute a single LDAP search for all User objects in both directories pointed against a single baseDN.

Is this possible?

share|improve this question
up vote 0 down vote accepted

In my opinion, setting up OpenLDAP is probably going to be more work than you want to go through for the convenience of running one LDAP query.

I would create a VBScript / PowerShell script to take a supplied query, execute it against both domains, and return the results to you.

This would be a fairly simple script to write. If I get some time later tonight and you haven't found a suitable solution (and you're interested), I'll try to cook one up.

share|improve this answer
Thanks for the offer to write the script- I don't think that will work for my client but it's a great idea. – karlcyr Feb 6 '10 at 3:49

I don't think any LDAP client tools will automatically perform the same query over two servers (unless the first server returns a referral to the second).

You could set up a LDAP proxy, using OpenLDAP 's meta backend, which acts as a proxy to integrate several naming contexts from several different servers in one single tree. I have successfully used it to do just this on several Windows 2003 domains. Add the rewrite overlay and you can represent both domains under one LDAP tree.

For example, if you have several AD domains named COMPANYONE.COM and COMPANYTWO.NET, you would end up with the following LDAP tree:

  • o=all-companies
    • dc=companyone,dc=com,o=all-companies
      • Objects from domain COMPANYONE
    • dc=companytwo,dc=net,o=all-companies
      • Objects from domain COMPANYTWO

Thus, you could base searches on the base DN o=all-companies, which would return entries from both servers.

Check out OpenLDAP's back-meta man page.

share|improve this answer
Very interesting, thanks for the response. – karlcyr Feb 6 '10 at 3:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.