使用DirectorySearcher的C＃中的LDAP查询不返回任何内容

Question

I run the following LDAP query using DirectorySearcher which is bound to the root of the AD:

(&(|(objectClass=container)(objectClass=organizationalUnit))(!(distinguishedName=OU=)(*&^%\\\#@$!\\\#$%^,OU=xyxy.yxyx,OU=yyyy,OU=tttt,DC=base,DC=local)))

But, it does not return any OUs. When i run the same query with an other OU like below, i get all the other OUs in AD:

(&(|(objectClass=container)(objectClass=organizationalUnit))(!(distinguishedName=OU=SOMEOU,OU=xyxy.yxyx,OU=yyyy,OU=tttt,DC=base,DC=local)))

Basically, I am trying to run a query for all the OUs which exclude some specific OUs. I guess it has something to do with the special character in the OU name.

Answer 1

I am assuming the the name of the OU is )(*&^%\\#@$!\\#$%^ as it appears in active directory users and computers. If you open the attribute editor you would find the following value for the distinguishedName attribute: OU=)(*&^%\\\\\\#@$!\\\\\\#$%^,OU=.... (notice that here the number of backslashes doubled and an extra backslash is added).

Based on this MSDN page , ( , ) , * , and \\ (and others) need to be escaped.

• * becomes \\2a

• ( becomes \\28

• ) becomes \\29

• \\ becomes \\5c

So your OU name in the LDAP filter should become OU=\\29\\28\\2a&^%\\5c\\5c\\5c#@$!\\5c\\5c\\5c#$%^,OU=....

Please note that you need to escape the \\ characters here or use @ in C# to create a verbatim string like this:

string dn = @"OU=\29\28\2a&^%\5c\5c\5c#@$!\5c\5c\5c#$%^,OU=...