Using LDAP accept query on same listened with multiple AD domains

[Jernej Vodopivec]

Hi, customer has a forest with multiple domains configured.

Here is the tree structure:

AD forest

- domain1

  - OU

    - user1 (user1@tld1.com)

- domain2

  - OU

    - user2 (user2@tld2.com)

Let's say I'm using a user located in domain2 for biding to LDAP. So the listener is configured to use a LDAP accept query for  domain2 users only. So the same user can't bind to domain1 to check if recipient email address exists in domain1.

Is there any way to overcome this issue expect to use smtp call-ahead?

[Ken Stieers]

A query to a domain controller that is also a global catalog on port 3268 (3269 if using ssl) should do it...  (this is what a GC is for...and gc's are what your Exchange servers should be pointed at...)

If they are trusting and not part of the forest, you can create either a "Domain Assignment" query, or a chained query to hit multiple Active Directories.

[michael.hesse]

Hi,

we had the same problem. Our solution was to create a LDAP Server-Profile for every domain using the GC Ports. (Ken is absolut right!)

All profiles are using the same service account, which is located in the root of the forrest.

Then we created chained queries and used them on the listener.