LDAP Filter & AD User Attribute

[ksgrg]

Hi Community,
Wonderful day today. Hope you all are doing well.

I need help regarding LDAP Filter and user synchronization based on AD attribute.

Currently the LDAP Filter is set to &(cn=*)

I have set the base DN to the root of users domain but the issue is it is actually syncing all the generic user accounts which I don't
Is it possible for us to sync users only with attribute employeeid present ?

Any help and suggestion is highly appreciated.

[ksgrg]

The situation was our users are scattered in various OUs and there isn't an option to specify more than one Base Bind DN.
So I found out we can create a distribution group in the AD, add all the users to this group and then set the following

Base DN: OU=Users,DC=domain,DC=local

LDAP Filter: &(objectCategory=Person)(memberOf=CN=Asset Management,OU=Group Resources,DC=domain,DC=local)

But I would still want to do it via the attribute employeeid to save myself from the hassle of creating groups and adding all the users to that group. Any suggestions are welcome.

[ksgrg]

Anyone please?

[ShaunNeighbourSwale]

I assume you tried this command in Powershell to check the filter?

Get-ADUser -LDAPFilter "(employeeid=*)"

If that's working in PS, but not here, it might be worth raising a bug/feature request.

[ksgrg]

Thank you &(employeeid=*) did the job but I will stick with the group as it's more controlled. The only thing is it synchronizes both the disabled and enabled accounts.

[ShaunNeighbourSwale]

See https://stackoverflow.com/questions/74468782/modifying-powershell-ldapfilter-to-add-enabled-true

Get-ADUser -LDAPFilter "(!(userAccountControl:1.2.840.113556.1.4.803:=2))(employeeNumber=*)"