Here is my working config - there are a few differences, but that may be due to your redaction etc. [my_scheme] SSLEnabled = 0 anonymous_referrals = 0 bindDN = CN=Splunk User,OU=Splunk,OU=SomeOU,OU=SomeOU,DC=domain,DC=com bindDNpassword = $1$someencryptedPassword= charset = utf8 emailAttribute = mail groupBaseDN = DC=domain,DC=com groupBaseFilter = (CN=splunk_*) groupMappingAttribute = dn groupMemberAttribute = member groupNameAttribute = cn host = dc.domain.com nestedGroups = 0 network_timeout = 20 port = 389 realNameAttribute = displayname sizelimit = 1000 timelimit = 15 userBaseDN = OU=my_users,DC=domain,DC=com userNameAttribute = samaccountname ... View more