How to correctly compose an ldap query on active directory to find users in a subgroup?

Question

LDAP

Hello everyone and good mood,
please help me figure out why ldap queries do not work for me. The purpose is that, I need to pull out all users from one subgroup. A simple example - I am a member of the "Domain Admin" group (Users container) , the same is in the "Administrators" group (Builin container) and I need to make a query that will show all users who are members of the "Administrators" group and its subgroups

Tried to make such requests:

(&(&(&(objectClass=user)(memberof:1.2.840.113556.1.4.1941:=CN=*,CN=*,DC=mydomen,DC=local))))

(&(&(memberOf=Администратор)))
and a bunch of other queries using the Active Directory Users and Computers snap-in, but it still didn't work.
Any help would be appreciated, thanks in advance!

Answer 1

Get-ADGroupMember with -Recursive option

Answer 2

Traverse nested groups recursively with separate queries.

Answer 3

Try this

ldapsearch  -S -P -H  ldap://domain.com -b 'dc=domain,dc=com' -D 'domain\DOMAIN_USER' -w 'DOMAIN_USER_PASS' '(&(memberof=CN=Администраторы,OU=Users,DC=domain,DC=com)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))' samaccountname