Active Directory search

The Active Directory search field lets you find and select a user, group, organizational unit or machine in UserLock, for example the target of an access policy.

• Results appear once you type at least 2 characters.

• Each result shows its parent container or organizational unit.

• The number of results is not limited.

• If the search takes more than 10 seconds, it continues and UserLock suggests refining the search term.

When a search returns results from several domains, each result displays a badge with its domain name.

A search returns the entities that have an attribute starting with the search term (prefix matching). A term that appears only in the middle of an attribute is not matched. This follows the native Active Directory behavior and keeps searches fast in large directories.

For example, for a user named John Smith, joh and smi find the user, but mit doesn’t.

The attributes compared depend on the entity type:

ANR (Ambiguous Name Resolution) is an Active Directory search that matches the beginning of several name attributes at once, such as first name, last name, display name and logon name.

The domain picker next to the search field sets where the search runs. The entries it lists and the default scope depend on your environment:

Each entry searches:

Domains are listed by NetBIOS name, with child domains under their parent. Hover over a domain to display its FQDN.

UserLock lists the domains of a trusted forest in the domain picker when both conditions are met:

• A two-way forest trust exists between the current forest and the trusted forest. External trusts and domain trusts are not supported.

• The UserLock server can reach a domain controller in each domain of the trusted forest. For the required ports, see Communication and required protocols.

UserLock updates the list of domains:

• When the UserLock Service Helper service starts.

• Every 12 hours.

• A few minutes after a failed update.