Search filter for changed objects in ADS

Search filter for changed objects in ADS

Post by YTS » Fri, 30 May 2003 12:11:45



Hi,

Problem:
USNChanged value for users and groups.
============================

If group a group "Group A" contains 10 users/members
and then I remove one user/member from that group.

Then query for the USNChanged value for the
objectClass=group and objectClass=user objectCategory = organizationalPerson
objectCategory=person.
The LDAP query filter only returns the group.

But inreality the user also has a change in his/her memberof property why is
the user not returns for the query
as a result.
Is it because "memberof" is one of  MS implimentaion rather than LDAP?

YTS

 
 
 

Search filter for changed objects in ADS

Post by Richard Mueller [MVP » Sat, 31 May 2003 06:13:45


Hi,

I have confirmed what you found, but cannot explain it.

--
Richard
Microsoft MVP Scripting and ADSI
http://www.rlmueller.net
--

Quote:> Hi,

> Problem:
> USNChanged value for users and groups.
> ============================

> If group a group "Group A" contains 10 users/members
> and then I remove one user/member from that group.

> Then query for the USNChanged value for the
> objectClass=group and objectClass=user objectCategory =

organizationalPerson
Quote:> objectCategory=person.
> The LDAP query filter only returns the group.

> But inreality the user also has a change in his/her memberof property why
is
> the user not returns for the query
> as a result.
> Is it because "memberof" is one of  MS implimentaion rather than LDAP?

> YTS


 
 
 

Search filter for changed objects in ADS

Post by YTS » Tue, 03 Jun 2003 16:21:24


Richard,

Thanks for your time,interest and expertise.

But I 've done a workaround since it returns the group information.

Regards
Tony



> Hi,

> I have confirmed what you found, but cannot explain it.

> --
> Richard
> Microsoft MVP Scripting and ADSI
> http://www.rlmueller.net
> --


> > Hi,

> > Problem:
> > USNChanged value for users and groups.
> > ============================

> > If group a group "Group A" contains 10 users/members
> > and then I remove one user/member from that group.

> > Then query for the USNChanged value for the
> > objectClass=group and objectClass=user objectCategory =
> organizationalPerson
> > objectCategory=person.
> > The LDAP query filter only returns the group.

> > But inreality the user also has a change in his/her memberof property
why
> is
> > the user not returns for the query
> > as a result.
> > Is it because "memberof" is one of  MS implimentaion rather than LDAP?

> > YTS

 
 
 

Search filter for changed objects in ADS

Post by Marc Scheuner [AD MVP » Tue, 03 Jun 2003 16:38:46


Quote:>Problem:
>USNChanged value for users and groups.
>============================

>If group a group "Group A" contains 10 users/members
>and then I remove one user/member from that group.

>Then query for the USNChanged value for the
>objectClass=group and objectClass=user objectCategory = organizationalPerson
>objectCategory=person.
>The LDAP query filter only returns the group.

>But inreality the user also has a change in his/her memberof property why is
>the user not returns for the query as a result.
>Is it because "memberof" is one of  MS implimentaion rather than LDAP?

I would believe it's because "memberOf" is not really a property of
the user that gets stored in AD - it's being calculated from the
group's perspective. AD really stores which objects are members of a
group - not the other way around. (you can't add a user to a group by
updating the user's "memberOf" property - you have to use the group
you want to add the user to, and add that account to the group's
"member" list).

If you look at the "memberOf" property of a user, it gets determined
from the groups the user belongs to.

Thus, since it's not really a property of the user, if you remove a
user from a group, you don't really change anything in the user object
- thus, the USNchanged doesn't get updated.

All you gurus out there - does that make any sense?? :-)

Marc

================================================================
Marc Scheuner                        May The Source Be With You!
Bern, Switzerland                         m.scheuner(at)inova.ch

 
 
 

Search filter for changed objects in ADS

Post by Richard Mueller [MVP » Wed, 04 Jun 2003 03:14:52


Hi,

I "think" you are correct. What bothers me is that the memberOf attribute is
not constructed (operational). I cannot find any decent documentation on
this attribute. Actually, it's the Is-Member-Of-DL attribute. The LDAP
display name is memberOf.

--
Richard
Microsoft MVP Scripting and ADSI
http://www.rlmueller.net
--



Quote:> >Problem:
> >USNChanged value for users and groups.
> >============================

> >If group a group "Group A" contains 10 users/members
> >and then I remove one user/member from that group.

> >Then query for the USNChanged value for the
> >objectClass=group and objectClass=user objectCategory =

organizationalPerson
Quote:> >objectCategory=person.
> >The LDAP query filter only returns the group.

> >But inreality the user also has a change in his/her memberof property why
is
> >the user not returns for the query as a result.
> >Is it because "memberof" is one of  MS implimentaion rather than LDAP?

> I would believe it's because "memberOf" is not really a property of
> the user that gets stored in AD - it's being calculated from the
> group's perspective. AD really stores which objects are members of a
> group - not the other way around. (you can't add a user to a group by
> updating the user's "memberOf" property - you have to use the group
> you want to add the user to, and add that account to the group's
> "member" list).

> If you look at the "memberOf" property of a user, it gets determined
> from the groups the user belongs to.

> Thus, since it's not really a property of the user, if you remove a
> user from a group, you don't really change anything in the user object
> - thus, the USNchanged doesn't get updated.

> All you gurus out there - does that make any sense?? :-)

> Marc

> ================================================================
> Marc Scheuner                        May The Source Be With You!
> Bern, Switzerland                         m.scheuner(at)inova.ch

 
 
 

Search filter for changed objects in ADS

Post by YTS » Thu, 05 Jun 2003 09:12:12


Hi Marc,

You may be right.

It would have been beautifull if it 'd returned the user
in question for usnChanged query regardless of whatever the way the object
model has been implemented.

But it returns the group even if we did the change for the
user actually it should have return the user as well.

I think somebody from microsoft might have to look at this.

Regards
YTS



Quote:> >Problem:
> >USNChanged value for users and groups.
> >============================

> >If group a group "Group A" contains 10 users/members
> >and then I remove one user/member from that group.

> >Then query for the USNChanged value for the
> >objectClass=group and objectClass=user objectCategory =

organizationalPerson
Quote:> >objectCategory=person.
> >The LDAP query filter only returns the group.

> >But inreality the user also has a change in his/her memberof property why
is
> >the user not returns for the query as a result.
> >Is it because "memberof" is one of  MS implimentaion rather than LDAP?

> I would believe it's because "memberOf" is not really a property of
> the user that gets stored in AD - it's being calculated from the
> group's perspective. AD really stores which objects are members of a
> group - not the other way around. (you can't add a user to a group by
> updating the user's "memberOf" property - you have to use the group
> you want to add the user to, and add that account to the group's
> "member" list).

> If you look at the "memberOf" property of a user, it gets determined
> from the groups the user belongs to.

> Thus, since it's not really a property of the user, if you remove a
> user from a group, you don't really change anything in the user object
> - thus, the USNchanged doesn't get updated.

> All you gurus out there - does that make any sense?? :-)

> Marc

> ================================================================
> Marc Scheuner                        May The Source Be With You!
> Bern, Switzerland                         m.scheuner(at)inova.ch

 
 
 

1. Filter to search only objects with "user" in the AdsPath

Hi NG,

Problem: To speed up searches through many OU's I want to search only
cn's in ou's named "users" in the tree.
But the following filter doesn't work:

strFilter = "(&(objectClass=User)
  (objectCategory=person)
  (adspath=*users*)
  (|(cn=*" & strSearchMe & "*)
  (sAMaccountname=" & strSearchMe & "*)))"

Is it not possible to use adspath or parent in filter definitions?

Thanks for any help,

Sven

2. Surfboard 3100 Can signal level affect cps (connection speed)?

3. Searching for Objects in AD

4. MUTI POINT STUN CONFIG

5. global catalog and searching for AD objects

6. Problems with BCC/Win under OS/2

7. HOWTO filter away disabled users when searching in AD using DirectorySearcher in .NET??

8. HPGL/2 plotfile viewer

9. change ad object

10. Is there way to change a property from optional to mandatory for and object in AD?

11. How do you Change the FULLNAME property of an object in AD?

12. Change user object attribute on all users in AD domain

13. C# interop: Change ACE of object in AD