I am trying to figure out how to query AD for a group and get its memberOf
attribute to show all the members, even cross-domain ones.
I will give an example:
- I have two domains:
one.company.com
two.company.com
- I have three groups:
one\group1
one\group2
two\group3
one\group1
is a member ofone\group2
andtwo\group3
I am trying to write a query to find all memberOf
for one\group1
.
No matter what query I try, the memberOf
attribute only returns one\group2
.
<GC://DC=company,DC=com>;(&(objectCategory=group)(objectClass=group)(distinguishedName=CN=group1,OU=....,DC=one,DC=company,DC=com));name,memberOf;subtree
<GC://DC=one,DC=company,DC=com>;(&(objectCategory=group)(objectClass=group)(distinguishedName=CN=group1,OU=....,DC=one,DC=company,DC=com));name,memberOf;subtree
<LDAP://DC=company,DC=com>;(&(objectCategory=group)(objectClass=group)(distinguishedName=CN=group1,OU=....,DC=one,DC=company,DC=com));name,memberOf;subtree
<LDAP://DC=one,DC=company,DC=com>;(&(objectCategory=group)(objectClass=group)(distinguishedName=CN=group1,OU=....,DC=one,DC=company,DC=com));name,memberOf;subtree
I am trying to do it this way because ultimately there are multiple groups I want to get memberOf
for so if I can get this to work then I can just put them all in (|...)
in the search filter and only make one call.