{"id":152,"date":"2008-11-09T20:32:28","date_gmt":"2008-11-10T02:32:28","guid":{"rendered":"http:\/\/idubbs.com\/blog\/?p=152"},"modified":"2008-11-09T20:32:28","modified_gmt":"2008-11-10T02:32:28","slug":"testing-and-tweaking-the-ldap-filter-for-your-profile-import-connections","status":"publish","type":"post","link":"https:\/\/www.idubbs.com\/blog\/2008\/testing-and-tweaking-the-ldap-filter-for-your-profile-import-connections\/","title":{"rendered":"Testing and tweaking the LDAP filter for your profile import connections"},"content":{"rendered":"

<\/a>Note: This post got a lot longer than I anticipated – even without screenshots – and because I don’t want to lose you before you get to what I consider the good stuff, I have it labeled as such below and you can jump right to it if you want.\u00a0 In order to provide what I consider a more complete story however, I feel obligated to provide a little foundation first for those that are interested.\u00a0 \ud83d\ude42<\/p>\n

The background \/ foundation:<\/span>
\nAs part of setting up a SharePoint (MOSS) environment, administrators need to configure the Profile Import in SSP in order to\u00a0get user accounts\u00a0from Active Directory into the SharePoint Profile database.\u00a0 By default, SharePoint will import all users from the Current domain – which is not always the desired list of accounts.\u00a0<\/p>\n

To change the accounts that are being imported, you can do the following:<\/p>\n

    \n
  1. From the Shared Services home page, select User profiles and properties<\/strong><\/li>\n
  2. Select View import connections<\/strong><\/li>\n
  3. Hover over the name of your connection and select Edit<\/strong><\/li>\n
  4. The Search Settings section of the Edit Connections page will display the Search base<\/strong> and the User filter<\/strong> values.\u00a0<\/li>\n
  5. If users from a particular directory node is desired, you can make changes in the Search base<\/strong> field.<\/li>\n
  6. We’re currently talking about\u00a0tweaking the values in the User filter<\/strong> field.\u00a0Default value:
    \n(&(objectCategory=Person)(objectClass=User))Minimum change you should use\u00a0per the MS article (below)\u00a0to remove disabled accounts:
    \n(&(objectCategory=person)(objectClass=user)( !(userAccountControl:1.2.840.113556.1.4.803:=2)))<\/li>\n<\/ol>\n

    The default User filter will likely import more accounts than you are intending for use in SharePoint.\u00a0 Remember, the accounts that are imported will also be crawled by the search indexer and will be available as search results from the People Search scope.\u00a0 Because of this, we want to keep the accounts imported to a minimum so that the search results aren’t cluttered\u00a0up with non-useful information.\u00a0<\/p>\n

    There are a number of good references out there for help with creating a specific\u00a0LDAP filter for your import, including one by MS:\u00a0 http:\/\/support.microsoft.com\/kb\/827754<\/a>\u00a0\u00a0<\/p>\n

    The good<\/em> stuff:<\/span>
    \nThere are a lot\u00a0of queries and filters\u00a0available, depending on what you’re looking to filter.\u00a0 Regardless, what IS irritating is having to change your filter,\u00a0Start full\u00a0import<\/strong> and then View user profiles<\/strong> over and over until you get the list of accounts that you like.\u00a0\u00a0So, what\u00a0I’ve really been building up to is to use the following as a way to shortcut that process and test your\u00a0LDAP filter before using it\u00a0for your\u00a0SSP import.\u00a0 \u00a0\u00a0<\/p>\n

      \n
    1. Go to Run -> mmc\u00a0 (This is the Microsoft Management Console)<\/li>\n
    2. Once the application starts, select File -> Add\/Remove Snap-in…<\/li>\n
    3. Select Add<\/strong><\/li>\n
    4. Select Active Directory Users and Computers<\/strong>.\u00a0 Select Add<\/strong>, then Close<\/strong><\/li>\n
    5. Select OK<\/strong><\/li>\n
    6. Active Directory Users and Computers<\/strong> should now be on the Console<\/li>\n
    7. Expand Active Directory Users and Computers<\/strong> and the current domain should be visible<\/li>\n
    8. Select the current domain, and the accounts, etc should be visible in the right pane<\/li>\n
    9. Right click on the current domain in the left pane, and select Find<\/strong><\/li>\n
    10. In the Find dropdown, select Custom Search<\/strong><\/li>\n
    11. Select the Advanced<\/strong> tab<\/li>\n<\/ol>\n

      You should now be able to enter an LDAP query string and test it to see if you are getting the approximate number of users that you’d expect in your SSP Profile Import.\u00a0 For starters, you could cut and paste the default value of the User Filter and see what users are returned by pressing the Find Now button.\u00a0 A list of accounts and a count should be returned by the tool.\u00a0<\/p>\n

      Now, a few more notes for after you’ve found the filter value you want.\u00a0 Once you’ve entered your new filter value and re-run the full import, you may notice that the Number of user profiles number reported on the User Profiles and Properties<\/strong> page hasn’t changed.\u00a0 The page you want to check View User Profiles<\/strong>.\u00a0 This page will show you both the total number of user profiles, as well as the list of active<\/em> user profiles, which is likely a lower number and hopefully matches the number that the mmc tool reported during your testing of the query.\u00a0<\/p>\n

      Now what you need to do, and why you should tweak your import query before<\/em> your first import, is remove all the accounts you don’t want.\u00a0 On the View User Profile page, change the View<\/strong> dropdown from Active Profiles<\/strong> to Profiles missing from import<\/strong>.\u00a0 You need to select each account, or each screen-full of accounts and delete them.\u00a0 (I hope you don’t have a lot, because that will be a pain.)\u00a0<\/p>\n

      Once you’ve got all the junk cleaned out, start a full crawl on your profile database and your index should also be updated.\u00a0<\/p>\n

      Thanks to Brian<\/a> for showing me this a few months ago… I’ve used it a bunch of times and have since passed it on to\u00a0a number of co-workers and clients alike.\u00a0 Hopefully you’ll find it handy as well.<\/p>\n

      \u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"

      Note: This post got a lot longer than I anticipated – even without screenshots – and because I don’t want to lose you before you get to what I consider […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[11],"tags":[],"class_list":["post-152","post","type-post","status-publish","format-standard","hentry","category-sharepoint"],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/pgWQ1-2s","jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/www.idubbs.com\/blog\/wp-json\/wp\/v2\/posts\/152","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.idubbs.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.idubbs.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.idubbs.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.idubbs.com\/blog\/wp-json\/wp\/v2\/comments?post=152"}],"version-history":[{"count":0,"href":"https:\/\/www.idubbs.com\/blog\/wp-json\/wp\/v2\/posts\/152\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.idubbs.com\/blog\/wp-json\/wp\/v2\/media?parent=152"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.idubbs.com\/blog\/wp-json\/wp\/v2\/categories?post=152"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.idubbs.com\/blog\/wp-json\/wp\/v2\/tags?post=152"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}