If I use ldapsearch on my Active Directory to bring back members of the Engineers team I only see 25 users. However in AD there are almost 50 users in Engineers. What am I doing wrong?

ldapsearch -p 389 -h -D "CONTOSO\ADReadOnly" -w ************ -b     "ou=ContosoUsers,dc=CONTOSO,dc=COM" -x "(&(objectClass=user)(sAMAccountName=*)(memberof=cn=Engineers,ou=Teams,ou=ContosoUsers,dc=CONTOSO,dc=COM))" | grep sAMAccountName
  • 25 seems kinda strange but try the -z option with a different value. Have you tried dsquery yet? – tony roth Apr 15 '13 at 20:32

Could it be that you don't have rights to read the group membership information (or other attributes?) of the "missing" objects? Try

ldapsearch -p 389 -h -D "CONTOSO\ADReadOnly" -w ************ -b "dc=CONTOSO,dc=COM" -x "(&(objectClass=user)(sAMAccountName=A_MISSING_USERS_SAM))" *

Do you see the missing user's sAMAccountName? Do you see ANY attributes? If not, you probably have a permissions issue reading the object's attributes.

Also, are you sure the missing users are all under the ContosoUsers OU?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.