CODEWITHSUNDEEP
active-directory
Sasikumar
Sasikumar

Reputation: 25

How to find trusted domain groups using Ldap query

I have one forest like demo.com. In the forest contains two domains are first.demo.com and second.demo.com then I have several users in first.demo.com and created a group using that user. Again I created one group in second.demo.com using first.demo.com user. I want to get both groups using LDAP query.

Upvotes: 1

Views: 2486

Answers (1)

Theo
Theo

Reputation: 61068

When you run an ldap query, you query an LDAP partition, i.e. DC=first,DC=demo,DC=com. The partition DC=second,DC=demo,DC=com maybe is in the same forest, but is hosted on another domain controller and is a specific partition.

The global catalog holds information for the whole forest, but as it contains all users and groups accross the forest, some attributes are not recorded in (to minimize its size).

If you query an attribute that is not in the global catalog, my suggestion is that you should script your ldap query like this:

  • query the forest domain root to get the list of all domains in the forest

  • for each domain, run your ldap query

Upvotes: 1

Related Questions