Active Directory Cookbook

4.8. Searching with an Attribute-Scoped Query

Tip

This recipe requires the Windows Server 2003 forest functional level.

Problem

You want to retrieve attributes of objects that have been set in a multivalued-linked attribute, such as the member attribute on group objects. An attribute-scoped query can do this in a single query, instead of the previous method, which required multiple.

Solution

Using a graphical user interface

1. Follow the steps in Recipe 4.3 to enable an LDAP control.

2. Select the Attribute Scoped Query control (you can select controls by name with the Windows Server 2003 version of LDP). For the Windows 2000 version of LDP, add a control with an OID of 1.2.840.113556.1.4.1504.

3. For Value, enter the multivalued attribute name (e.g., member).

4. Click the Check in button.

5. Click OK.

6. From the menu, select Browse → Search.

7. For BaseDN, type the DN of the object that contains the multivalued DNs.

8. For Scope, select Base.

9. For Filter, enter an LDAP filter to match against the objects that are part of the multivalued DN attribute.

10. Click Run.

Using a command-line interface

At the time of publication of this book, no CLI tools supported attribute-scoped queries.

Using VBScript

At the time of publication of this book, you cannot use attribute-scoped queries with ADSI, ADO, and VBScript. In an ADO search, you can use the ADSI Flags property as part of a Connection object to set the search preference, but there is no way to set the attribute that should be matched, which must be included as part of the ...