title: LDAP: using a filter to avoid a sub CN in Active Directory
body: <p>I am trying to query nearly all users in Active Directory.
  My normal users are in various OUs, and I want to retrieve those. But my system users are stored in the Users CN, and I don't want to retrieve those.</p>
  
  <p>It looks a lot like <a href="https://stackoverflow.com/questions/1101144/ldap-using-a-filter-to-avoid-a-sub-ou-in-active-directory">another question</a>, but their answer didn't help me. I'm using the hint provided <a href="http://lists.fini.net/pipermail/ldap-interop/2005-February/000294.html" rel="nofollow noreferrer">here</a>, but its not helping out either.</p>
  
  <p>I am querying in Active Directory using JNDI. My query is:</p>
  
  <pre><code>(&amp;(objectClass=user)(!(cn:dn:=Users)))
  </code></pre>
  
  <p>This means all objects of class <code>user</code>, which are not in the <code>Users</code> subtree. Yet, this query nevertheless returns something like this:</p>
  
  <pre><code>CN=__vmware__,CN=Users,DC=SIREDRM,DC=com
  </code></pre>
  
  <p>So, why is that filter not working? How else can I make it work?</p>