LDAPsearch is not showing latest group membership

[jdunlea]

I have recently added a user to a group.

When I query the user's AD object using ldapsearch, I can see his group membership, however the new group that he was added to is nowhere to be seen.

What is the issue here? Is there some sort of AD cache that the ldapsearch command is querying and the new group membership change has not been updated in the cache? (Or something like that)

[jdunlea · Accepted solution]

Turns out the problem was the type of group that I was looking at. It was a global group and not a universal group in AD and hence it was not propagating across all of the domains.

Once I changed the group type it worked perfectly.

Thanks for the help!

[nnmiller]

Have you verified that AD is properly replicating?

Try using an AD account with admin privileges to do the ldapsearch command. If that account can see the members, then the generic ldap query user does not have the proper permissions to read the AD objects; you will have to add read group membership (at a minimum) to the generic ldap query user's permissions.