Ldap 查询以获取 Active Directory 中组的用户

Question

I'm trying to write a filter to get all the users of a given group in Active Directory.

To that end I have the following query

LDAPSearch("DC=test,DC=myorg,DC=com", "(objectClass=user)", 1, "name")

I'm a bit confused as to where I should give the name of the group on which to base the search on. As far as I know you cannot have two groups in AD with the same name.

Answer 1

In general, user objects have an attribute called memberOf that lists DNs of groups that a user is member of. Therefore you can search with a filter like (&(objectClass=user)(memberOf=<DN of requested group>)) .

Please note that due to AD design, user's primary group is not included in memberOf attribute. For most users that group would be Domain Users (unless explicitly changed), but if changed, that group will no longer list in memberOf and this query will not find such user.