title: LDAP: Enumerate Organizational Unit users
body: <p>I'm trying to list all users located in an Organizational Unit within a domain using LDAP (<a href="http://msdn.microsoft.com/en-us/library/system.directoryservices.directorysearcher.aspx" rel="nofollow noreferrer"><code>DirectorySearcher class</code></a>).</p>
  <p>The domain I'm connecting to isn't the current domain, and the OU I'm trying to look at is in a very deep path with some of the OU names repeated elsewhere, e.g.:</p>
  <blockquote>
  <p><strong>MyDomain.LOCAL</strong>/MyCompany/Clients/Contoso/Financial Site/Financial Services/<strong>Users</strong></p>
  </blockquote>
  <p>I'm able to list all users within the domain with the following code:</p>
  <pre><code>// Build the directory entry
  var directoryEntry = new DirectoryEntry(_ldapServer, _domain + &quot;\\&quot; +
      _systemUser, _systemPassword);
  try
  {
      // Bind to the native AdsObject to force authentication of the system user.
      // It will throw an exception if this is an invalid account
      object obj = directoryEntry.NativeObject;
  }
  catch (Exception ex)
  {
      throw new Exception(&quot;Error authenticating system user. &quot; + ex.Message, ex);
  }
  
  // create a directory searcher for that OU  
  DirectorySearcher users = new DirectorySearcher(directoryEntry);
  
  // set the filter to get just the users
  users.Filter = &quot;(&amp;(objectClass=user)(objectCategory=Person))&quot;;
  
  // add the attributes you want to grab from the search
  users.PropertiesToLoad.Add(&quot;givenName&quot;);
  users.PropertiesToLoad.Add(&quot;sn&quot;);
  users.PropertiesToLoad.Add(&quot;mail&quot;); 
  users.PropertiesToLoad.Add(&quot;name&quot;); 
  
  // grab the users and do whatever you need to do with them
  var allFound = users.FindAll();
  foreach (SearchResult oResult in allFound)
  {
      // etc
  }
  </code></pre>
  <p>This works, and grabs a huge list of all the users that are located in the root (domain).<br />
  However, I wish to get the users under the specific OU.</p>
  <p>I have tried the following line:</p>
  <pre><code>var directoryEntry = new DirectoryEntry(_ldapServer +
      &quot;/ou=MyCompany/Clients/Contoso/Financial Site/Financial Services/Users&quot;,
      _domain + &quot;\\&quot; + _systemUser, _systemPassword);
  </code></pre>
  <p>And I get the error:<pre>Error authenticating system user. An operations error occurred.</pre></p>
  <p>Does anyone know how I be more specific in the <code>DirectorySearcher</code> for the OU I'm interested in?</p>
  <hr />
  <h2>SOLVED!</h2>
  <p>The final path string (for my example) should be the following (without the line-breaks):</p>
  <pre>LDAP://DomainControllerServer/OU=Users,OU=Financial Services,
      OU=Financial Site,OU=Contoso,OU=Clients,OU=MyCompany,
      DC=MyDomain,DC=LOCAL</pre>
  <pre>
  DomainControllerServer = IP address in my case.
  -- FQDN: MyDomain.LOCAL - Period-separated into DC={part} list
   |-- OU: MyCompany
     |-- OU: Clients
       |-- OU: Contoso
         |-- OU: Financial site
           |-- OU: Financial Services
             |-- OU: Users
  </pre>
  <p>Remember to escape invalid characters with a backslash (<code>\</code>), such as any of the following: <code>+ , \ = /</code>.</p>
  <p>This was a nightmare, but thankfully it works now.</p>