ActiveDirectory - LDAP query for objectCategory unexpected results

Posted by FinalizedFrustration on Server Fault See other posts from Server Fault or by FinalizedFrustration
Published on 2012-03-30T16:19:28Z Indexed on 2012/03/30 17:32 UTC
Read the original article Hit count: 271

Filed under:
|

AD is at 2003 functional level, some of our DC's are running Windows Server 2003, some are 2008, some are 2008 R2.

When using the following query:

(objectCategory=user)

I do not expect to see any result where the objectCategory attribute is equal to 'CN=Person,CN=Schema,CN=Configuration,DC=Contoso'

I expect only objects where the objectCategory attribute is equal to 'CN=User,CN=Schema,CN=Configuration,DC=Contoso'

However, the query does indeed return all objects with the objectCategory attribute equal to 'CN=Person,CN=Schema,CN=Configuration,DC=Contoso'

My question then is this: Why do I see the search results that I do? Does AD actively translate queries that include (objectCategory=user) to (objectCategory=Person)? I have looked at the schema definitions for both the Person and the User class, but I cannot see any reason for the query results as I am experiencing them. I know that the User class is a subclass of the organizationalPerson class, which is a subclass of Person, but I can't see an attribute value that would explain this translation.

© Server Fault or respective owner

Related posts about active-directory

Related posts about ldap