Query for Global Catalog fails to fetch the object details

Question

I have a windows AD server machine (2012 windows), say 'abc.com'. From the client, I try with port '636' and '3269'.

With port '636' and base-dn set as 'DC=abc,DC=com' and bind-dn set as 'CN=Administrator,DC=abc,DC=com', I am able to lookup for a user and get its details.

However, when I try using global catalog port '3269', I get entry not found error for the same uesr. I tried to provide a blank (" ") for the base-dn and bind-dn in this case but that also couldn't help.

I am not sure how to make a successful search into the global catalog. Can someone help.

Answer 1

You need to use an ""<empty string" for the baseDN AND a scope=base.

Access does not even require authentication, although you may not get all the data you are looking for.

ldapsearch -H ldaps://example.net:3269 -b "" -s base -z 1000 "(objectClass=*)" "objectClass"