Windows: How do I find an LDAP User and their Group Base DN for Microsoft Active Directory?

To find the user and group base DN, you can run a query from any member server on your Windows domain.

To find the User Base DN:
– Open a Windows command prompt.
– Type the command: dsquery user -name <known username>
(Example: If I were searching for all users named John, I could enter the username as John* to get a list of all users who’s name is John)

example: dnsquery user -name *john*
– The result will look like: “CN=John.Smith,CN=Users,DC=MyDomain,DC=com”
– If you need this information for configurations like  Blue Coat Reporter’s LDAP/Directory settings, when asked for a User Base DN, you would enter:  CN=Users,DC=MyDomain,DC=com
To find the Group Base DN:
– Open a Windows command prompt
– Type the command: dsquery group -name <known group name>.
(Example: If I were searching for a group called Users, I could enter the group name as Users* to get a list of all groups who’s name contains “Users”)
– The result will look like: “CN=Users,CN=Builtin,DC=MyDomain,DC=com”
– In Blue Coat Reporter’s LDAP/Directory settings, when asked for a User Base DN, you would enter: CN=Users,CN=Builtin,DC=MyDomain,DC=com.

TIP:  This link provides you with a discussion on what Microsoft tools are available: BLOG