• State Suggested Answer
  • Replies 3 replies
  • Answers 1 answer
  • Subscribers 62 subscribers
  • Views 1835 views
  • Users 0 members are here
Options
Related

Computer Dynamic Group Membership Rule Distinguished Name

barim
over 2 years ago

Hello,

I want to create a dynamic group including all computers with a Distinguished Name containing "CRETEIL".
Unfortunately, the membership rule "Computer distinguishedName Contains CRETEIL" doesn't return any items while many computers have "CRETEIL" in their Distinguished Names (see screenshot below).

For information, the correct domain is used.

In advance, thank you for your help.

Regards,

  • 0 over 2 years ago

    Hello,

    This is an Active Directory limitation. The distinguishedName attribute is a computed attribute, based on the objects's location: it is not a "real" attribute and it is not possible to perform a wildcard ("Contains") search on a computed attribute via LDAP.

    There are a number of different workarounds, depending on your needs and your environment.

    For example, if you only have a handful of these containers, then an "Equals" search with the full distinguishedName will return results.

    You could also create an Automation Workflow which stamped an Active Roles Virtual Attribute on all computer objects within one or more folder structures and then target your Dynamic Group at the stamped attribute.

    You could also introduce this as a real-time provisioning process, triggered by creation in or a move into/out of a folder tree.

    You might also be able to create a complex LDAP query using the LDAP_MATCHING_RULE_IN_CHAIN OID, but that comes with its own issues as it isn't fully supported in an Active Roles Dynamic Group.

  • 0 over 2 years ago

    A further difficulty with the DN is that in my experience its composition (containing commas) makes it unfriendly for LDAP queries.

    I was going to suggest you try searching on the CanonicalName property.

  • 0 over 2 years ago in reply to JohnnyQuest

    I thought about it but I didn't managed to find CanonicalName and edsvaParentCanonicalName properties to try searching on:

    https://photos.app.goo.gl/gTppk72KexnBGFV86