# Active Directory LDAP User Search Filter - Filter out memberOf specific group(s) **URL:** \ **Category:** Ignition\ **Created:** [October 20, 2019, 9:57pm UTC](https://forum.inductiveautomation.com/t/active-directory-ldap-user-search-filter-filter-out-memberof-specific-group-s/29228 "2019-10-20T21:57:41Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![rpavlicek](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/rpavlicek/32/55868_2.png) [@rpavlicek](https://forum.inductiveautomation.com/u/rpavlicek)\ **Post date:** [October 20, 2019, 9:57pm UTC](https://forum.inductiveautomation.com/t/active-directory-ldap-user-search-filter-filter-out-memberof-specific-group-s/29228/1 "2019-10-20T21:57:41Z")
Under User Sources (in Gateway Settings \> Config \> Security \> Users, Roles), we set up an Active Directory source to use LDAP. In the User Search Filter, what syntax can I use to narrow down to only look for users that are members of a specific group or groups of our Active Directory? In the User Search Base, I want to use the whole domain, so I would put (DC=companyname,DC=com). But I need to filter this down to users that are only part of a certain group in the User Search Filter. If I don’t, it takes a long time and seems to hang up since it’s looking at all users in AD. I’ve tried many things, but can’t get it to work. I’m not referring about the Roles Filter section. I know how to narrow down to the Security Groups in AD for Ignition to search through in Roles. Thanks. ---
**Author:** ![Sonny\_Vallgren](https://avatars.discourse-cdn.com/v4/letter/s/e19b73/32.png) [@Sonny\_Vallgren](https://forum.inductiveautomation.com/u/Sonny_Vallgren)\ **Post date:** [February 13, 2020, 9:00am UTC](https://forum.inductiveautomation.com/t/active-directory-ldap-user-search-filter-filter-out-memberof-specific-group-s/29228/2 "2020-02-13T09:00:24Z")
Did you solve it? I’m struggling with exactly the same problem. ---
**Author:** ![rpavlicek](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/rpavlicek/32/55868_2.png) [@rpavlicek](https://forum.inductiveautomation.com/u/rpavlicek)\ **Post date:** [February 13, 2020, 4:58pm UTC](https://forum.inductiveautomation.com/t/active-directory-ldap-user-search-filter-filter-out-memberof-specific-group-s/29228/3 "2020-02-13T16:58:06Z")
Yes, hopefully this helps you and others. The method that we needed to use was the User List Filter along with the User Listing Base and User Search Filter. It’s helps to get the DistinguishedName of the path to the OU you want to use (Like Sysinternals AD Explorer). I will describe the filters strings below. #Use to narrow down which Organizational Units to search for. The more you use, the faster the audit roles will be. Being too broad can make it slower. To do this you combine your OU’s seperatley with parenthesis. **User Listing Base** : (OU=SomeOU,DC=Domain,DC=com)(OU=SomeOtherOU,DC=Domain,DC=com)(OU=YetAnotherOU,DC=Domain,DC=com) #This was the most important and needed help from IA support. **User List Filter** :(&(objectCategory=person)(objectClass=user)(!(objectClass=computer))(|(memberOf=CN=_YourOUGroup_,OU=Security Groups,OU=_SubsubFolderOU_,OU=_SubFolderOU_,OU=_MainOU_,DC=Domain,DC=com))) #Left this as default. **User Search Filter** : (&(objectClass=user)(sAMAccountName={0})) ---
**Author:** ![melwadeya](https://avatars.discourse-cdn.com/v4/letter/m/ed8c4c/32.png) [@melwadeya](https://forum.inductiveautomation.com/u/melwadeya)\ **Post date:** [December 9, 2020, 4:20pm UTC](https://forum.inductiveautomation.com/t/active-directory-ldap-user-search-filter-filter-out-memberof-specific-group-s/29228/4 "2020-12-09T16:20:48Z")
Thanks for sharing the solution. I am fairly new to AD, could you please confirm what OU actually is? is it the group name? what are: > [@rpavlicek](#): > > _SubsubFolderOU_ ,OU= _SubFolderOU_ ,OU= _MainOU_ which parameters of the expression I should change to narrow AD query to 2 groups? any help is greatly appreciated. ---
**Author:** ![GPT](https://avatars.discourse-cdn.com/v4/letter/g/ee7513/32.png) [@GPT](https://forum.inductiveautomation.com/u/GPT)\ **Post date:** [June 5, 2026, 4:56pm UTC](https://forum.inductiveautomation.com/t/active-directory-ldap-user-search-filter-filter-out-memberof-specific-group-s/29228/5 "2026-06-05T16:56:24Z")
Hello First of all, thanks for providing this information. I am currently working in 8.3 version trying to set up AD purely where groups would determine the level of access. For some reason, the way i have set it up only auth against the whole domain and not the group by default. Below is my configuration. I attempted your method and still no luck. Several combination attempted and no luck. With service account. User search base (CN=APP\_CS\_DEV,OU=APP,OU=Groups,DC=GPT,DC=com) User search filter default User list filter (&(objectCategory=person)(objectClass=user)(!(objectClass=computer))(|(memberOf=CN=APP\_CS\_DEV,OU= APP,OU=Groups,DC=GPT,DC=com))) Every other parameter is default in that regard. Domain is also auth with service account. Any help is appreciated. #Ignition #LDAP #AD ---
**Author:** ![michael.flagler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/michael.flagler/32/26272_2.png) [@michael.flagler](https://forum.inductiveautomation.com/u/michael.flagler)\ **Post date:** [June 5, 2026, 7:44pm UTC](https://forum.inductiveautomation.com/t/active-directory-ldap-user-search-filter-filter-out-memberof-specific-group-s/29228/6 "2026-06-05T19:44:21Z")
Keep in mind the filters in the AD configuration only limit what you can see in the Ignition web interface. It does not limit who can log in in my experience. Login permissions are done via roles based on group access and will need to be configured separately. ---
**Author:** ![daniel.wachholbinger](https://avatars.discourse-cdn.com/v4/letter/d/e9a140/32.png) [@daniel.wachholbinger](https://forum.inductiveautomation.com/u/daniel.wachholbinger)\ **Post date:** [June 18, 2026, 1:02pm UTC](https://forum.inductiveautomation.com/t/active-directory-ldap-user-search-filter-filter-out-memberof-specific-group-s/29228/7 "2026-06-18T13:02:57Z")
Hi all, it is also not working for me. The main problem is, that authentication allways works with all users, no matter in which OU. Tried several combinations - also using the User List Filter. However I cannot work with Groups, this would not be manageable in my organization. User Search Base `OU=Regular Users,OU=Site1,OU=Company,DC=Company,DC=Local` The structure in AD: Company -- Site1 -- Site2 However, when authenticating, users from site 2 can login too. The only effect is the manage users list, which is queried only from site 1. It seems, this has something to do with Automatic Suffix and then the user is searched globally. Any ideas? ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [June 18, 2026, 1:29pm UTC](https://forum.inductiveautomation.com/t/active-directory-ldap-user-search-filter-filter-out-memberof-specific-group-s/29228/8 "2026-06-18T13:29:37Z")
> [@daniel.wachholbinger](#): > > I cannot work with Groups Change this. You need some kind of key for your auth that is delivered with the user information, and groups is the common solution. The manage users list is a convenience, not a key part of authentication. ---
**Author:** ![Chris\_Bingham](https://avatars.discourse-cdn.com/v4/letter/c/e5b9ba/32.png) [@Chris\_Bingham](https://forum.inductiveautomation.com/u/Chris_Bingham)\ **Post date:** [June 18, 2026, 4:46pm UTC](https://forum.inductiveautomation.com/t/active-directory-ldap-user-search-filter-filter-out-memberof-specific-group-s/29228/9 "2026-06-18T16:46:22Z")
> [@daniel.wachholbinger](#): > > The main problem is, that authentication allways works with all users, no matter in which OU. This has not been my experience. I've had to add each OU explicitly in the User Search Base in order to allow users from different Organizational Units to gain access. 🤔