Splunk Search
Highlighted

How to use ldap search to get computers from multiple groups?

Path Finder

I would like to use an LDAP search to find computers located in multiple groups. I tried something like this, but I cant get the syntax correct or even know if it's possible. I'm trying to find all computers in the patch1 and patch2 groups.

| ldapsearch domain=mydomain.com search=(&(objectClass=computer)(memberOf="CN=Patch1, OU=Patches,OU=Wintel,DC=Mydomain,DC=com) AND (memberOf="CN=Patch2, OU=Patches,OU=Wintel,DC=Mydomain,DC=com) ) attrs=name
0 Karma
Highlighted

Re: How to use ldap search to get computers from multiple groups?

Communicator

Do you want accounts that are in both patch1 and patch 2? Try this:

(&(objectClass=computer)(memberOf=CN=Patch1,OU=Patches,OU=Wintel,DC=Mydomain,DC=com)(memberOf=CN=Patch2, OU=Patches,OU=Wintel,DC=Mydomain,DC=com))

When you query ldap, the sections enclosed in parentheses will set by the initial operator, this case "AND" (&), so what you're asking for is:

( (objectClass=computer) AND (memberOf=CN=Patch1,OU=Patches,OU=Wintel,DC=Mydomain,DC=com) AND memberOf=CN=Patch2,OU=Patches,OU=Wintel,DC=Mydomain,DC=com) )

If, for example, you wanted to find computers that were either in one group or the other, instead of both, the query would be:

 (&(objectClass=computer)(|(memberOf=CN=Patch1,OU=Patches,OU=Wintel,DC=Mydomain,DC=com)(memberOf=CN=Patch2,OU=Patches,OU=Wintel,DC=Mydomain,DC=com)))

View solution in original post

0 Karma
Highlighted

Re: How to use ldap search to get computers from multiple groups?

Path Finder

I am not able to get your first example to work without an error. I can do this below with quotes:

(&(objectClass=computer)(memberOf="CN=Patch1,OU=Patches,OU=Wintel,DC=Mydomain,DC=com"))

I tried to do:

(&(objectClass=computer)(memberOf="CN=Patch1,OU=Patches,OU=Wintel,DC=Mydomain,DC=com")(memberOf="CN=Patch2,OU=Patches,OU=Wintel,DC=Mydomain,DC=com"))

that is not working either.

0 Karma
Highlighted

Re: How to use ldap search to get computers from multiple groups?

Communicator

Try it without quotes ... and if there's still a problem, try

(&(objectClass=computer)(memberOf=*))

As a starting point, and you can also add a name filter with a wildcard ...

(&(objectClass=computer)(memberOf=*)(name=WKS-*))

When you're stuck it's not a bad idea to find to a point where your query works, then start narrow it down.

0 Karma
Highlighted

Re: How to use ldap search to get computers from multiple groups?

Path Finder

I have tried every combination I can think of. This works fine:

)

If I try to add something like (&(objectClass=computer)(memberOf=)(name=wintel)) to the search it will show similar data, but only with servers that contain the name *wintel.

0 Karma
Highlighted

Re: How to use ldap search to get computers from multiple groups?

Communicator

Try this:

| ldapsearch search="(&(objectCategory=computer)(|(memberOf=CN=Patch1,OU=Patches,OU=Wintel,DC=Mydomain,DC=com)(memberOf=memberOf=CN=Patch2, OU=Patches,OU=Wintel,DC=Mydomain,DC=com)))" | stats values(memberOf) as memberOf, count(memberOf) as group_count by name

This should list computers that are members of either group - from that you can see if you have the bisection of computers that exist in both groups. If you search for just members of one group do you get any results?

| ldapsearch search="(&(objectCategory=computer)(memberOf=CN=Patch1,OU=Patches,OU=Wintel,DC=Mydomain,DC=com))
0 Karma
Highlighted

Re: How to use ldap search to get computers from multiple groups?

Path Finder

That did it! thanks so much.

0 Karma
Highlighted

Re: How to use ldap search to get computers from multiple groups?

Path Finder

I think you want "objects that are computers AND (are in group1 OR are in group2)"

 (&(objectClass=computer)(|(memberOf="CN=Patch1,OU=Patches,OU=Wintel,DC=Mydomain,DC=com") (memberOf="CN=Patch2,OU=Patches,OU=Wintel,DC=Mydomain,DC=com")))

Hope this helps

0 Karma