I created a group in AD and added one computer to it. Then created an LDAP label with a base DN that's a bit higher than I'd like in the chain. Meaning that base DN is DC=domain, DC=com, when I'd prefer it to be like below.
I'd like to use this DN, but it won't let me type it in. Kace is pulling the DN from it's own configuration.
Base DN I'd like: CN=Comps_TECH,OU=Groups,OU=MYOU,OU=NAME1,OU=AD,DC=domain,DC=com
Search Filter: (&(memberof=CN=Comps_TECH,OU=Groups,OU=MYOU,OU=NAME1,OU=AD,DC=domain,DC=com)(samaccountname=KBOX_USER))

The LDAP label is growing and adding machines that are not in the Comps_TECH group.

How should I create the label so it only contains computers that are in the "Comps_TECH" group?
0 Comments   [ + ] Show Comments

Comments

Please log in to comment

Answers

0
If I'm not mistaken, Base DN needs to be as broad as possible, and can't be a group name. Therefore, you may want to use something like OU=MYOU,OU=NAME1,OU=AD,DC=domain,DC=com for your Base DN. Also, you're matching usernames, rather than PC names. Your filter would need to look something like this: (&(name=KBOX_COMPUTER_NAME)(memberof=CN=Comps_TECH,OU=Groups,OU=MYOU,OU=NAME1,OU=AD,DC=domain,DC=com))
Answered 02/24/2015 by: BHC-Austin
Fourth Degree Black Belt

Please log in to comment
0
Thank you. I was trying your first suggestion, but hadn't tried changing to KBOX_COMPUTER_NAME till I read your comment. Just made that change and everything tests successful in the LDAP Browser page, but it's not pulling machines into the label. 

If you're correct and it can't actually get down a group, then that stinks. LOL. My reasoning for doing this was so I wouldn't have to to focus on an OU. But it sounds like creating an OU and placing the machines from my group in that OU is the only option.

I'll try a few things before giving up. If there's any suggestions for how to search down to a group, please chime in. The function is in Kace since it does succeed at the LDAP browser page when I use KBOX_USER and search to a group with only computers in it. Just no luck with the actual label.

Thanks

Answered 02/24/2015 by: murbot
Tenth Degree Black Belt

  • You should be able to use Group membership, but using the filter, rather than the Base DN. Try expanding the base DN to DC=domain,DC=com and then filter as I suggested
Please log in to comment
Answer this question or Comment on this question for clarity