Searching an Entire Forest using Global Catalog.

[DocEvil]

Hi all,

I work for an organisation that has absorbed many others over the past few years. Now we have a few child domains in our AD forest, but we use the one domain name "@abc.com" for internet addressing.

I am currently writing an Application so my Helpdesk can automatically create mailboxes once our AD team has created the AD object. That part is easy, however the tricky bit is getting my App to make sure that the new user "Fred Bloggs" doesn't have a conflicting "Fred Bloggs" in another domain & therefore my new Fred gets "Fred.Bloggs2@abc.com".

The current search I'm doing is:

<LDAP://DC=abc,DC=com>;(&(objectCategory=person)(givenName=fred)(|(sn=bloggs)));name,distinguishedName,msExchHomeServerName,homeMDB,samAccountName,EmployeeID,ProxyAddresses

This works a treat when searching one domain, but nails me when trying to search the "Entrie Directory" like I can in ADUC.

Any suggestions on a fast, easy method of searching an Entire Forest from a GC would make my headache go away .

Thanks in advance.

Doc.

 

[tsuji]

>on a fast, easy method of searching an Entire Forest from a GC

The setting up of a search on the gc is ritually like this, just like setting up for a search on a domain.
[tt]
set oRootDSE=getobject("LDAP://RootDSE")
sforest=oRootDSE.get("rootDomainNamingContext")
'... preparation of the ado search
squery="<GC://" & sforest & ">;" & sfilter & ";" & sattributes & ";subtree"
'...
[/tt]
But the problem is that the attribute set must be those which are replicated to the gc. Hence, in the sfilter and the sattributes, you are restricted to a subset of available attributes to objects in the directory.

Now, givenName and sn are not by default replicated, I think, but you have to check your directory's customized setting. You can either make them attributes replicated or, I don't know, make your attribute of Fred.Blogg@abc.com be one. But doing that must be well planned as adding attributes to gc slow the replication and also once added you won't be able to delete it. On this aspect, check out these kb articles to start with.

http://support.microsoft.com/default.aspx?scid=kb;en-us;256938

http://www.microsoft.com/technet/pr...elp/75938b11-90e9-406f-86ec-1b7448ab1bca.mspx

- tsuji

 

[tsuji]

Correction

My last post:
>Now, givenName and sn are [red][black]not[/black][/red] by default replicated...
should be read:
Now, givenName and sn are by default replicated...

I think I have by a slip of reasoning have a _not_ too many. GivenName and sn are global catalog attributes. Hence you can safely proceed with the filter you have in mind. Just have a check on the sattributes (attributes to be retrieved) that's the message I would have to convey.

- tsuji