Polycom 3725-77601-001H manual Understanding Exclusion Filters

Directory Operations

Therefore, to use these character as part of a name, they must be preceded in the Base DN field by a backslash. For example, the baseDN of an ou named "tom,ann,bob" in the "myteam.example.com" domain must be entered as:

ou=tom\,ann\,bob\ dc=my team,dc=example,dc=com

Or the baseDN of an ou named "#+,=<>\ " in the "mydomain.example.com" domain must be entered as

ou=\#\+\,\=\<\>\\\ ,dc=mydomain,dc=example,dc=com

Note that this applies only to attribute values, not the ou= or dc= structure.

Understanding Exclusion Filters

Using LDAP exclusion filters, you can exclude objects in your directory based on a wide variety of criteria within your Active Directory environment. Any LDAP filters that you create must follow the LDAP standard and reference the LDAP display name of the attributes against which you are filtering.

The following table illustrates some basic examples of exclusion filter expressions.

Search baseDN expression	Description
Memberof=cn=Restricted Group,OU=users,dc=example,dc=com	Excludes all users who are members of
	"Restricted Group" within the Users OU in the
	example.com domain.
!(Memberof=cn=Video Users,OU=Users,dc=example,dc=com)	Includes only groups and users within the
	Video Users group in the Users OU in the
	example.com domain.

Creating exclusion filters can impact the performance of your LDAP queries. As a best practice, use indexed attributes and do not use medial searches when implementing exclusion filters. For more information, see Creating More Efficient Microsoft Active Directory-Enabled Applications.

Polycom, Inc. 361