Unable to exclude object from a Business Unit with Query

Question

Hello,

I have some AD Groups I would like to exclude from a business unit I'm using. I have standard group names across multiple OUs, some should be a part of the business unit, others should not.

The Membership rules specify that all children of the Customers OU should be included. Then I have an Exclude by Query to find all groups with Admin in the group name.

When I create the query it looks like this: (&(objectCategory=group)(cn=*Admin*))

When I click on the Affected Objects button I can see only the groups I want to exclude, I have the Exclude Specified Objects checkbox checked.

However when I apply the membership rule I can still see the groups under the business unit and the people using the web console can still see them.

I did try adding the specific groups to the business unit rather than using the query and that works but would be a lot harder to automate than simply having a working exclude query. Any thoughts on how I can get this working?

Comments

I found my own answer here:

http://www.adaxes.com/help/?BusinessUni ... rview.html

The different methods for including objects in a business unit are ranked in priority. Query is the last priority method so my Container Children Membership rule on the top level OU was overriding my Exclude object Query. It would be neat if we could control priority by the order of the membership rules in the list.

To fix my problem I created a scheduled task to add all the groups matching the common naming scheme to a "HideObjectsFromSupport" AD Group and set a membership rule to exclude direct members of that group. It's not as dynamic as a query because my task only runs once or twice a day but it'll work.

Answer 1

Hello,

Thanks for your suggestion, but currently we are not planning anything like that.

By the way, actually you can create a Business Unit like you want. To do this:

1. Create a new Business Unit.

2. On step 2 of the Create Business Unit wizard, click Add.

3. Select Query Results.

4. Click the Select button associated with the Look in field.

5. Select your Customers OU and click OK.
   

6. In the Filter field, specify the following LDAP filter:

   (&(objectCategory=*)(!(|(&(objectCategory=group)(cn=*Admin*))(distinguishedName=OU=Customers,DC=example,DC=com))))

   where OU=Customers,DC=example,DC=com is the Distinguished Name (DN) of your Customers OU.
   

7. Click OK, and then click Finish.

Comments

Oh wow that works way better. thanks!