ldap queries and sync with an AD

Question

Hey all,

I am new to active directory.

I am trying to get all objects - user, groups using LDAP queries.

If I don't know what is the structure of the company ( forest, domains, etc) and the company has no GC, how do I get all user and groups objects using LDAP? should I query every dc ( every dc that controls domain) ? or there is another way?

can be common objects between domains? what should I be aware of?

Thanks.

Answer 1

Hi. Thank you for your question and reaching out. I’d be more than happy to help you with your query

Without being aware of the organizational structure of the company, you can query each domain controller (DC) to obtain all user and group objects using LDAP. Using an LDAP browser, such as Apache Directory Studio or Softerra LDAP Browser, is the simplest way to accomplish this. By connecting to each DC using these, you can look for the user and group objects you require.

You should be aware that there can be items shared by various domains when inquiring across them. The Global Catalog (GC) can be used to query all of the objects across all of the domains if you need to query data from many domains. You will need to query each DC separately if the business doesn't have a GC, though. Furthermore, you should be aware that some properties might only be accessible within specific domains, necessitating the use of several domain queries to obtain all relevant data.

If the reply was helpful, please don’t forget to upvote or accept as answer, thank you.