---
locale: "en"
updated_at: "2026-10-20T15:14:28.004Z"
canonical: "https://www.isdecisions.com/en/userlock/docs/reference/core-concepts/active-directory-search"
---

# Active Directory search

Search fields, term matching, domain picker and trusted forests.

## Active Directory search fields

The Active Directory search field lets you find and select a user, group, organizational unit or machine in UserLock, for example the target of an access policy.

![Search results for "admin" with the All scope, each result showing its container and a domain badge such as Org, Rcorp, Test or Vcorp.](https://a.storyblok.com/f/122374/581x262/5ddbdd4cb6/ad-search-results.png)

- Results appear once you type at least 2 characters.
- Each result shows its parent container or organizational unit.
- The number of results is not limited.
- If the search takes more than 10 seconds, it continues and UserLock suggests refining the search term.

When a search returns results from several domains, each result displays a badge with its domain name.

## Search term matching

A search returns the entities that have an attribute starting with the search term (prefix matching). A term that appears only in the middle of an attribute is not matched. This follows the native Active Directory behavior and keeps searches fast in large directories.

For example, for a user named John Smith, `joh` and `smi` find the user, but `mit` doesn’t.

The attributes compared depend on the entity type:

| Entity | Attributes searched |
| --- | --- |
| **Users** | ANR, `mail`, `userPrincipalName` |
| **Machines** | ANR |
| **Groups** | `cn`, `name`, `sAMAccountName` |
| **Organizational units** | `ou`, `name` |

ANR (Ambiguous Name Resolution) is an Active Directory search that matches the beginning of several name attributes at once, such as first name, last name, display name and logon name.

> **Note**
>
> - Local accounts of the UserLock server, in [Standalone](/userlock/docs/reference/core-concepts/servers-types#standalone-terminal-server) mode, are matched on any part of their account name.
> - To match any part of names instead, see [FAQ > Configuration](/userlock/docs/support/faq/configuration#336029c3-e907-4b5a-97e5-a426f93434c2).

## Search across several domains

The domain picker next to the search field sets where the search runs. The entries it lists and the default scope depend on your environment:

| Environment | Domain picker entries | Default scope |
| --- | --- | --- |
| One domain | ❌ Picker hidden | Current domain |
| Several domains in one forest | - Global catalog, - Each domain | **Global catalog** |
| Trusted forests | - All, - Global catalog, - Each domain | **All** |
| [Standalone](/userlock/docs/reference/core-concepts/servers-types#standalone-terminal-server) mode, domain-joined machine | - All, - Local (SERVERNAME) - Each domain, | **All** |
| [Standalone](/userlock/docs/reference/core-concepts/servers-types#standalone-terminal-server) mode, workgroup machine | ❌ Picker hidden | Local accounts of the UserLock server |

Each entry searches:

| Entry | Searches |
| --- | --- |
| **All** | Every domain of every forest. In Standalone mode, also the local accounts of the UserLock server. |
| **Global catalog** | Every domain of the current forest. Trusted forests are not included. |
| **Domain name** | That domain only. |
| **Local (SERVERNAME)** | Local accounts of the UserLock server only. |

Domains are listed by NetBIOS name, with child domains under their parent. Hover over a domain to display its FQDN.

![Domain picker open next to the search field, showing All, Global catalog with the CORP, TEST and ORG domains, and the trusted forest domain REMOTE-CORP.](https://a.storyblok.com/f/122374/569x256/fbb0b665a4/ad-search-domain-picker.png)

## Search across trusted forests

UserLock lists the domains of a trusted forest in the domain picker when both conditions are met:

- A two-way forest trust exists between the current forest and the trusted forest. External trusts and domain trusts are not supported.
- The UserLock server can reach a domain controller in each domain of the trusted forest. For the required ports, see [Communication and required protocols](/userlock/docs/reference/modules/communication-required-protocols).

UserLock updates the list of domains:

- When the UserLock Service Helper service starts.
- Every 12 hours.
- A few minutes after a failed update.

> **💡 Tip**
>
> To display a newly created trust without waiting for the next update, restart the **UserLock Service Helper** service on the UserLock server.