英文:
Active Directory Group Members don't match member attribute
问题
我正在与一个供应商合作，他需要使用LDAP查询从我们的Active Directory中提取信息。该查询直接从AD组的'members'属性中提取信息。然而，它只提取了该组中20多个用户中的8个。如果我查看组的“成员”选项卡，我可以看到所有的用户，而且他们可以正常工作。但当我切换到“属性”选项卡并滚动到“members”条目以查看值时，只显示了8个用户。LDAP查询只提取了这8个用户，而没有提取其余的用户。
如何修复这个问题，使属性和成员列表匹配，而不需要删除/重新创建该组？如果删除并重新创建，会影响我们的生产环境。
我已经尝试过从组中删除并重新添加用户，但问题没有得到解决。
英文:
I'm working with a vendor who needs to use LDAP queries to pull information on our Active Directory. The query pulls from the 'members' attribute of the AD Group directly. However it only pulls 8 of the 20+ users in this group. If I look at the group's Members tab, I can see all of the users, and they work without an issue. I switch to the Attributes tab and scroll to the members entry view the values which shows only 8 of the users. The LDAP query only pulls these 8 and not the rest of the users.
How do I fix this so the attribute and members list match without deleting/recreating the group? If I delete and recreate it would take down our production environment.
I've tried removing and re-adding users to the group and it does not fix the issue.
答案1
得分: 1
我猜测这个组是你在member属性中看不到的用户的主要组。如果组是主要组，成员就不会出现在member属性中。我不知道为什么会这样……归咎于Microsoft。
要找到这些用户，请查看组的primaryGroupToken。它将是一个数字。然后搜索具有该值的用户，在它们的primaryGroupId属性中。
通常，主要组是内置的域用户组，其primaryGroupToken始终为513。因此，要查找这些用户，您可以使用此LDAP查询：
(primaryGroupId=513)
根据文档，primaryGroupId属性已被索引，因此您不需要其他条件。
如果您想了解更多关于成员资格如何工作的信息，我之前写了一篇关于成员是如何定义的？的文章。
英文:
I'm going to guess that this group is the primary group for the users that you don't see in the member attribute. Members don't appear in the member attribute if the group is the primary group. I don't know why this is... blame Microsoft.
To find those users, look at the primaryGroupToken of the group. It will be a number. Then search for users that have that value in their primaryGroupId attribute.
Usually, the primary group is the built-in Domain Users group, which always has a primaryGroupToken of 513. So to find users of that, you would use this LDAP query:
(primaryGroupId=513)
According to the documentation, the primaryGroupId attribute is indexed, so you don't need any other criteria.
If you want to learn more about how memberships work, I wrote an article a while ago about What makes a member a member?
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论