title: LDAP query to return all groups in specified OU
body: <p>I am trying to update my filter currently appled to the People Picker in SharePoint (WSS). </p>
  
  <p>I am using stsadm to set the filter.</p>
  
  <p>Something like...</p>
  
  <pre><code>stsadm -o setproperty -url http://webserver:39770 -pn peoplepicker-searchadcustomfilter -pv "(&amp;(userAccountControl=512)(objectCategory=person)(objectClass=user)(memberOf=cn=All Users Group,ou=E-Mail Distribution Lists,dc=domain,dc=com,dc=au))"
  </code></pre>
  
  <p>I know how to do this but want to change the LDAP query. This is where I need your help.</p>
  
  <p>I would like to query an OU in AD and return all the groups in it.</p>
  
  <p>As a fall back I could put all groups in the OU into their own group and just query the group using the following query... </p>
  
  <pre><code>(&amp;(memberOf=CN=WSSPeoplePickerGroup,OU=Groups,DC=domain,DC=com,DC=au)(objectCategory=group))
  </code></pre>
  
  <p>... but I would like to directly query the OU if I can. It has become a bone I don't want to let go of just yet, so hopefully there is someone smarter than me out there.</p>
  
  <p>I think where I need to head is something like the following query I found. As I understand it this is known as an <em>extensible search match</em> and they are filtering on the 'name' of OU but I am having trouble seeing how I might apply this to what I want (despite the numerous attempts I have made), if this is indeed the approach I should take.</p>
  
  <pre><code>(&amp;(objectClass=group)(&amp;(ou:dn:=Chicago)(!(ou:dn:=Wrigleyville))))
  </code></pre>
  
  <p>TIA</p>