Search for specific user in an Active Directory group

Hello,
I have an OU containing a number of Groups. Each group contains a number of members.
I'm currently retrieving the entire list of members from each group by searching for the members attrib for each group. This is not an ideal approach as the query execute time is a bit too long.
from what I can tell, the group class is group (opposed to a groupofuniquenames). Is there a way to query for the specific member?
Thanks

Thanks for the reply.
I have read the first post you gave, but not the second. I'm off to read that now.
My main concern is that I don't have access to the DN of the user in the member attrib. I have access to their CN and uid (which is indexed). From what I can recall from when I last updated this code, I couldn't create a wildcard search filter e.g.,:
(&(cn=All Scientists)(objectClass=Group)(member=CN=Albert Einstein*))
If that's correct and I require a DN, is there any way around this?
I was interested in the posixGroup and groupOfUniqueNames classes. I wasn't aware that these were available through Active Directory, but I see them listed in the AD schema (http://msdn.microsoft.com/en-us/library/ms683908(VS.85).aspx).
If I'm correct, posixGroup would allow for a filter of (&(cn=All Scientists)(objectClass=posixGroup)(memberUid=AEinstein))
I'm not sure how typical it is to use the posixGroup class in AD and I'll have to check with my AD team before moving forward with this. But I wanted to get some more direction/ideas before asking them to create some posixGroup objects for me.
I'm now going to go and read the second post you linked, but I wanted to put the rest of my details out there.
Thanks again.

Similar Messages

Search for single member in an Active Directory Group

Hello all,
I'm attempting to find a better method to search if a user is a member of a group in Active Directory. I currently retrieve the entire member attribute of the group.
I need to reduce the time of the query. I would like to be able to search for a specific member (user) of the group instead of retrieving the entire member list of the group.
I can post my current code if that would help.
I believe the default Active Directory group object is the ldap group. I know that there are posixGroup and groupOfUniqueNames ldap classes available, but I'm not sure if Active Directory has access to those classes.
Is my request possible using the group ldap object?

Thanks for the reply.
I have read the first post you gave, but not the second. I'm off to read that now.
My main concern is that I don't have access to the DN of the user in the member attrib. I have access to their CN and uid (which is indexed). From what I can recall from when I last updated this code, I couldn't create a wildcard search filter e.g.,:
(&(cn=All Scientists)(objectClass=Group)(member=CN=Albert Einstein*))
If that's correct and I require a DN, is there any way around this?
I was interested in the posixGroup and groupOfUniqueNames classes. I wasn't aware that these were available through Active Directory, but I see them listed in the AD schema (http://msdn.microsoft.com/en-us/library/ms683908(VS.85).aspx).
If I'm correct, posixGroup would allow for a filter of (&(cn=All Scientists)(objectClass=posixGroup)(memberUid=AEinstein))
I'm not sure how typical it is to use the posixGroup class in AD and I'll have to check with my AD team before moving forward with this. But I wanted to get some more direction/ideas before asking them to create some posixGroup objects for me.
I'm now going to go and read the second post you linked, but I wanted to put the rest of my details out there.
Thanks again.

Find Label Missing in Advanced Search For Specific User

for specifi users FIND label is showing but some of the users in advanced search this find label is missing . top of the applictaion it is there
plz let me know why this is problem is coming
find button should visible to all users......................
give me repaly ASAP

Hi
CRM 5.0
its not related to application,modification ..but my problem is the find label is working for some of the users.but some of the users find label is not there,
plz let me know where i have to make corrections for this problem........

Exch 2013 SP1 How to create new mailbox account for multiple users exist in active directory in one go?

Hi,
First let me explain my Exch 2013 SP1 Multidomain set up.
1. DA as Forest Root domain, having schema master domain role installed.
DB as Tree Root domain in above forest
DC as Child domain in Tree root domain.
Brought 1 machine in Child domain and in stalled Exch 2013 SP1 on it.
Now i have created 100 users in child domain, but i am not getting a option to enable Exchange mailbox for all 100 users in one go. (Also unable to do same on normal set up having one DC and Exch 2013 SP1 server)
Could you please help me do it.
Thanks & Regards,
Sudhir

Dear Sudhir
Please try this through Exchange management shell and it will help you
Get-User -RecipientTypeDetails User -Filter { UserPrincipalName -ne $Null } | Enable-Mailbox
Remember to mark as helpful if you find my contribution useful or as an answer if it does answer your question.That will encourage me - and others - to take time out to help you Check out my latest blog posts on http://exchangequery.com Thanks Sathish
(MVP)

Managing Office 365 Components for a large enterprise using Active Directory

Opening Office 365 to a large enterprise (7000 users) implies some controls be placed around who can subscribe to what and which Add-Ons a user might have/need/desire access to.
To place these controls around, for example, licensing Project Online to individual users, we are proposing creation of Active Directory groups for each add-on and use powershell or other method to read the AD FS user groups, then flip the bit on the O365
user profile for that member to allow them to select the Add-On.
At any point in time, our Asset Management team can use the AD group to determine licensing distribution and chargeback to internal cost centers.
Does this seem like a viable approach?
Any other approaches that have worked?

John,
After your users and home profile paths are created in AD - have your tried running the createhomedir command from Terminal? Assuming your AD plugin settings are correct on your server - specifically the 'Use UNC path...' - try running the command (in Terminal) below on your document (home folder) server:
sudo createhomedir -s
This command should query your server's search path (check the path using Directory Utility - located in /SystemLibrary/CoreServices) and find any users (preferably your AD network accounts - that's the -s option) that should have home folders on that server and create them. Note that this command nust be run as root - hence the sudo
To test - try creating a new AD user and point their profile to your Mac sharepoint - then run the command. You could also run the command on your Mac server to create an account for just the new user - just add their name at the end of the command above:
sudo createhomedir -s newusername
Hopefully one of these suggestions will work for you...
Ken

SharePoint 2013 Workflow (SPD 2013) fails for Active Directory Group members

Hi
I have a SharePoint 2013 site called "Team Meetings". There are a number of lists and an InfoPath form library.
The site's SharePoint Group "Team Meeting Members" has two Active Directory groups (All Club Managers and All Club Police) as members. Those two AD groups contain all the people that I want to have access to the library and list, except for
a few additional folk who I have made individual members.
My PROBLEM:
I have created a SharePoint 2013 Workflow using SPD 2013 associated with the Form Library. Workflow is set to start on new or modified item. The first action is to write to history list, then determine the status (Submitted or Pending) of
the form and go to different Stages depending on that status.
The workflow works perfectly for any user who has been added directly to the SharePoint group (Team Meetings Members) BUT FAILS at the very first action for anyone who is a member of one of the AD groups. I know the Workflow is fine because I've tested it
with numerous people who are direct members of the SharePoint Group, but whenever a person who is a member of the AD group tries it the Workflow just fails.
Here's a print of the info from the Workflow Status page (I don't have access to server logs):
RequestorId: 4494760f-92ff-2e8c-90d2-cc7df0e6baa4. Details: System.ApplicationException: HTTP 401 {"Transfer-Encoding":["chunked"],"X-SharePointHealthScore":["0"],"SPRequestGuid":["4494760f-92ff-2e8c-90d2-cc7df0e6baa4"],"request-id":["4494760f-92ff-2e8c-90d2-cc7df0e6baa4"],"X-FRAME-OPTIONS":["SAMEORIGIN"],"MicrosoftSharePointTeamServices":["15.0.0.4420"],"X-Content-Type-Options":["nosniff"],"X-MS-InvokeApp":["1;
RequireReadOnly"],"Cache-Control":["max-age=0, private"],"Date":["Mon, 10 Mar 2014 01:31:42 GMT"],"Server":["Microsoft-IIS\/8.0"],"WWW-Authenticate":["NTLM"],"X-AspNet-Version":["4.0.30319"],"X-Powered-By":["ASP.NET"]}
The HTTP response content could not be read. 'Error while copying content to a stream.'. at Microsoft.Activities.Hosting.Runtime.Subroutine.SubroutineChild.Execute(CodeActivityContext context) at System.Activities.CodeActivity.InternalExecute(ActivityInstance
instance, ActivityExecutor executor, BookmarkManager bookmarkManager) at System.Activities.Runtime.ActivityExecutor.ExecuteActivityWorkItem.ExecuteBody(ActivityExecutor
Members of the SharePoint Group "Team Meetings Members" have Contribute Access to both the form library and another list that the workflow writes to as well as the Workflow History list (which in SP 2013 uses the credentials of the
user who started the workflow, unlike 2010 which used System Account).
All members of the Team Meetings Members group, whether they are individual members or part of one of the AD groups, have no problems opening and saving forms etc. It's just the Workflow that doesn't like them...
I am stumped. I've spent many hours searching for a reason for this. There are about 200 people in the two AD groups so I really don't want to have to add them all individually - especially when these groups are managed in AD for a whole bunch of other reasons
and using the AD groups means I'll basically never have to worry about modifying the SharePoint access permissions.
Does anyone have any ideas why this is happening and what I can try to fix it?
Mark

Hi Lars,
I'm afraid not so far but we are trying a few things today so I will post back with results.
First thing we are doing is making the AD Group universal because one of our (external provider) gurus remembers seeing something about that. He also sent me a link to a post where they were talking about earlier
versions but having similar issues and their solution was to make sure the app pool account has sufficient permissions in AD::
http://social.msdn.microsoft.com/Forums/sharepoint/en-US/27a547da-5cc0-49d7-8056-6eb40b4c3242/failed-to-start-workflow-access-is-denied-exception-from-hresult-0x80070005-eaccessdenied
This part of that thread looks interesting but we haven't checked it yet as were trying the universal setting first:
"If the users participating in the workflows have been added to the SharePoint site via Active Directory groups, SharePoint has to update the user’s security token periodically by connecting to
the domain controller. By default, the token times out every 24 hours. But if the application pool account did not have the right permissions on the domain controller to update the user’s token, user will keep getting the access denied error. The error was
intermittent because when the user browsed to any page other than the workflow form, the token was getting updated successfully.
You can try to fix it through granting the application pool account the appropriate permission by adding the account to the group “Windows Authorization Access Group” in Active Directory."
I'll update when we try these ideas. If you have any luck please do the same.
Mark
(sorry about formatting - using my phone....)
Mark

Create a User account in active directory from SharePoint online 2013 list data

Hello,
I am trying to create a SharePoint list through which i can create a user account into active directory,
1 - HR is sending the detail in the email body to a Specific email address ([email protected]) like below..
First Name: XYZ
Last Name: ABC
Address: ABC 123
Designation: Analyst
Employee ID: 10492
and so on
2 - I need to pickup every new email data of the above section into sharepoint list (in Column)
First Name Last Name Address Designation Employee ID
3 - I want to create a event receiver through which i can go ahead and find the new data in the list and then create a user in the active directory,
I tried very hard and since i dont have much experience in coding part, any help will be highly appreciated
Thank you
Aman

1- Configure Incoming Email Setting at your SharePoint Farm -
https://technet.microsoft.com/en-us/library/cc262947.aspx
http://blogs.technet.com/b/harmeetw/archive/2012/12/29/sharepoint-2013-configure-incoming-emails-with-exchange-server-2013.aspx
2- Configure your Sharepoint List Incoming e-mail settings for [email protected] - ListSetting-Communications->Incoming e-mail settings. -
https://support.office.com/en-in/article/Enable-and-configure-e-mail-support-for-a-list-or-library-dcaf44a0-1d9b-451a-84c7-6c52e7db908e
3- Write an Incoming Email Receiver , and Add you Email Body Parsing Code (retrive value of fields , firstname , lastname etc) in
EmailReceived() method. also add the code for adding new user in Active Directory
http://blogs.msdn.com/b/tejasr/archive/2010/03/06/event-handler-code-to-add-incoming-emails-with-subject-discussion-id-as-replies.aspx
https://pholpar.wordpress.com/2010/01/13/creating-a-simple-email-receiver-for-a-document-library/
4- Active Directory Code Help -
http://www.codeproject.com/Articles/18102/Howto-Almost-Everything-In-Active-Directory-via-C
http://www.codeproject.com/Tips/534718/Add-User-to-Active-Directory
Thanks
Ganesh Jat [My Blog |
LinkedIn | Twitter ]
Please click 'Mark As Answer' if a post solves your problem or 'Vote As Helpful' if it was useful.

Search for specific values (no *) in RSUSR070

I want to find all activity groups that contain a specific entry for authorization object P_ORGIN, Personnel Area field. I want to search for FL02 for example, but if I type FL02 in the selection field, I will also get any activity group that contains * as the value for Personnel Area. I tried putting FL02 in single quotes but that did not work either.
Any ideas?
Thanks,
Cindy

Alex69 wrote:
Thanks for the answer…
I thought maybe I'm doing something wrong or this is because i excluded the Time Machine volume from spotlight, but ok, not my fault, but an apple "feature"
I could search for specific E-mails using a finder search and then switch into Time Machine, but since Mail is called a Time-Machine-Aware Application I felt there should be a direct way to do this in Mail…
Yes, there "should be a direct way to do this."
The approach you describe above will work for email that still currently resides on your Mac, for example an email that has been "Replied" back and forth and you wish to retrieve an earlier version of the conversation. Or perhaps a "Draft" email that has undergone changes over time, of which you need to retrieve an earlier version. In these cases using Time Machine is relatively straight forward.
My problem with Mail/Time Machine is with a specific email that has since been deleted. Unless you know exactly what mailbox that email had been in, and at what time the email had existed, then it can be like searching for a needle in a haystack. In this case the Time Machine interface needs to have a search box added to the "time travel" windows for faster retrieval of specific items, the location of which the user doesn't remember.
I'm convinced, though, that the usability of Time Machine in such instances will improve over time. Particularly as more app become integrated with it.
Glenn

Disable user account on Active Directory??

I sync user account from iPlanet DS to Active Directory through Meta Directory. If I disable user account on iPlanet DS, can meta directory disable the user account on Active Directory Server?

AD has an attribute called userAccountControl. This attribute has a value of 512 when an AD account is active and 546 when it has been disabled. I flow a constructed attribute called userAccountControl with two rules, one for enable and one for disable. The selection criteria for the enable/disable rule is based upon a change in employee status. For example, (%mv.employeestatus%==T). Another way to do this would be a single attribute constructrion rule that calls an external script (written in Perl) that accounts for multiple conditions and then enables/disables the AD account accordingly. In the attribute flow rule, you flow the constructed attribute userAccountControl to mdsAdUserAccountControl (assuming an AD-Specific schema setting in the AD connector).

User profiles from Active directory when loggedin then userdisplay, useredit shows blank white screen in SharePoint 2013

User profiles from Active directory when loggedin then userdisplay, useredit shows blank white screen in SharePoint 2013
I can login with the these AD users and AD direct import is working just fine. We are not using UPS.
With admin user when I click on the user it shows up proper data. But when I login with the same user it does not show me userdisplay/useredit and shows blank data. Also another strange thing is when I add new item in list with these AD users created by
modified by is blank and its really strange. I checked user information list, tried to rerun user sync with direct AD import option but no success.
MCTS Sharepoint 2010, MCAD dotnet, MCPDEA, SharePoint Lead

Hi Amit,
According to your description, my understanding is that the page is blank when the use accessed /_layouts/15/userdisp.aspx and the created by field was blank when the user created a new list item in SharePoint 2013.
I tested the same scenario per your post, however I cannot reproduce your issue.
For troubleshooting this issue, I recommend to verify the things below:
Check the permission of the user in the corresponding site collection to see if he can access /_layouts/15/userdisp.aspx.
Delete the user from AD and SharePoint, then re-add the user to AD and grant proper permission to the user in SharePoint to see if the issue still occurs.
Did this issue occur with all the users? Add a new user in AD and test the same scenario.
Best regards.
Thanks
Victoria Xia
TechNet Community Support

Cisco ISE (Authentication failed: 24415 User authentication against Active Directory failed since user's account is locked out)

Hi,
I have a setup ISE 1.1.1. Users are getting authenticate against AD. Everything is working fine except some users report disconnection. I see in the ISE that (Authentication failed: 24415 User authentication against Active Directory failed since user's account is locked out). Users are using Windows 7 OS.
Error is enclosed & here is the port configuration.
Port Configuration.
interface GigabitEthernet0/2
switchport access vlan 120
switchport mode access
switchport voice vlan 121
authentication event fail action next-method
authentication event server dead action reinitialize vlan 120
authentication event server alive action reinitialize
authentication host-mode multi-auth
authentication order mab dot1x
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
mab
dot1x pae authenticator
dot1x timeout tx-period 60
spanning-tree portfast
ip dhcp snooping limit rate 30 interface GigabitEthernet0/2
switchport access vlan 120
switchport mode access
switchport voice vlan 121
authentication event fail action next-method
authentication event server dead action reinitialize vlan 120
authentication event server alive action reinitialize
authentication host-mode multi-auth
authentication order mab dot1x
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
mab
dot1x pae authenticator
dot1x timeout tx-period 60
spanning-tree portfast
ip dhcp snooping limit rate 30
Please help.

The error message means that Active Directory server Reject the authentication attempt
as for some reasons the user account got locked.I guess, You should ask your AD Team to check in the AD
Event Logs why did the user account got locked.
Under Even Viewers, You can find it out
Regards
Minakshi (Do rate the helpful posts)

Cisco ISE Failure: 24408 User authentication against Active Directory failed since user has entered the wrong password

Hi,
Since we implemented Cisco ISE we receive the following failure on several Notebooks:
Authentication failed : 24408 User authentication against Active Directory failed since user has entered the wrong password
This happens 2 or 3 times per Day. So basically the authentications are working. But when the failure appears, the connection is lost for a short time.
The Clients are using PEAP(EAP-MSCHAPv2) for Authentication. We've got a Cisco Wireless Environment (WLC 5508).
Why is this happening?
Thanks,
Marc

The possible causes of this error message are:
1.] If the end user entered an incorrect username.
2.] The shared sceret between WLC and ISE is mismatched. With this we'll see continous failed authentication.
3.] As long as a PSN not receiving a response from the supplicant within this limit during an EAP conversation, it will throw this error code. In majority of cases it says eap session timed out.
In your cases, the 3rd option seems to be the most closest one.
Jatin Katyal
- Do rate helpful posts -

Need to automatically add newly created user account in an existing active directory group.

Hi All ,
In my environment we are having window server 2012 active directory environment.We need to have the newly created active directory user account to get added automatically to the existing active directory group after that new user account creation.
Please tell us the possible ways to achieve this scenario.
Regards
S.Nithyanandham
Thanks S.Nithyanandham

Hi,
Can you please confirm your requirement,
When you create a new user account in AD, based on the user's property like Department, Job or Location, the user need to be added to your specific AD groups?
Regards,
Gopi
JiJi
Technologies

Syncing Active Directory Groups for Unity Distribution Groups

We have multiple remote stores with managers that move around quite a bit. This poses an administration nightmare when trying to keep voicemail distribution lists up to date. Is there a way to syncronize an active directory group to a Unity voicemail distribution group? Therefore when we move a manager around in ADS the user automatically moves in Unity.

Unfortunately this feature has not been re-implemented in Unity Connection. This is one of the few things from Unity that I miss. I suggest voicing your desire for this as a feature enhancement with your Cisco AM.
If you are doing that many changes you may want to consider going through the Cisco Unity Connection Provisioning Interface. At least you could script the changes there using code that checked AD group membership and replicated the changes into CUC.

How to transfer user accounts from Active Directory to Open Directory

Please help me , want to tranfer user accounts from Active Directory (Windows server 2012 ) to Open Directory (OS X server 10..2.9)

Hi,
Go to the advanced administration for the OSX Server:
https://help.apple.com/advancedserveradmin/mac/3.1/#apd6D7FE39D-32AA-400C-91E1-5 0ABC15655C8
This pretty easy way of connecting your server to the Windows server should give AD users access to OD services. That will be a good start.
Read up on this as well:
http://support.apple.com/kb/PH15469
Do you want to import them all or just the Mac users?
Goodluck!
Jeffrey

Search for specific user in an Active Directory group

Similar Messages

Maybe you are looking for