In our organization, we have ActiveDirectory set up with Identity Management for Unix (IDMU). When I look in ADUC on the Attribute Editor tab, I can see the posix attributes on my account (eg. gidNumber, uidNumber, etc...). However, if I run an ldapsearch against AD those attributes are not returned.

Here's the form of my command:

ldapsearch \
  -H 'ldaps://ad.example.org:3269' \
  -b 'dc=example,dc=org' \
  -s sub \
  -D 'CN=ldapsearch,OU=Service Accounts,OU=IT,DC=example,DC=org' \
  -y ~/password.txt \
  -o ldif-wrap=no \
  '(sAMAccountName=myuser)' cn uidNumber gidNumber

It only returns the dn & cn. The uidNumber & gidNumber attributes are omitted.

Any ideas?

1 Answer 1


It appears you're connecting to the Global Catalog port (3269) rather than the standard SSL port (636). The uidNumber and gidNumber attributes are not replicated to the Global Catalog by default, so it won't return them.

You can either change your port to 636 or if you need to be able to query these from Global Catalog servers, you can modify your AD schema to add them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.