LDAP exclude sub OU from search

Question

Say If I had a structure like the following:

How can I exclude A and B2?

_users
|__A
|__B
   |__B1
   |__B2
   |__B3
|__C
|__D

ou=users, dc=domain, dc=co, dc=uk;

Solution 1

An LDAP search is composed of 4 elements:

1. The node from which you ask to begin the search (the Distinguish Name of the node)
2. The scope of your search (base, onelevel, subtree)
3. The filter of your search (e.g. (objectClass=user))
4. The attributes you want to retrieve.

In Active Directory, there exists no "natural" way to exclude an OU from a recursive search.

Regarding LDAP, on the theoretical point of view, ExtensibleMatch exists and enables what you want to do, but it's not supported in Active Directory.

Solution 2

For me, I needed to easily exclude disabled users from ldap search results or anything else that would show these user accounts along side enabled (active) accounts. I denied list content access for the Disabled Users OU which leaves the OU visible but the contents are not. The result is that people searches from, let's say, bound Mac clients using the Contacts app will no longer see 'ghost' users.

Solution 3

I'm doing something similar. I first use a search for 'objectclass=organizationalunit' with the search scope set to 'OneLevel'. Code looks something like this:

DirectoryEntry oDE = new DirectoryEntry("LDAP://DC=ChildDomain,DC=RootDomain")
        using (DirectorySearcher ds = new DirectorySearcher(oDE))
        {
            ds.PropertiesToLoad.Add("dn");
            ds.SearchScope = SearchScope.OneLevel;
            ds.Filter = "(objectClass=OrganizationalUnit)";
            ds.PageSize = 30;

Then I use a foreach loop to cycle through the results and compare the distinguished name of each result with the one OU I'm excluding. If the OU's dn matches, I continue to the next result. If not, then I take some action.

Comments

[Prashant]

It works for me to exclude the distinguishedName path with Ad: serverfault.com/a/999758/4591

[Nathan Tuggy]

Doing something similar to what? Generally, answers should stand alone, quoting and linking to any other answers or external resources they use.