OU section
Valid arguments
- distinguished name of organizational unit (OU) with or without
'*' wildcard in the first OU - OU in Active Directory Users & Computers object location syntax with or without
*wildcard in the OU name
Purpose
Refer to one or more organizational units (OUs).
Supported wildcards and quoting
"…"— Quoting references in the section header with double quote marks is supported. If you need a literal double quote mark, escape the double quote mark by prefixing with a backslash (\"). Backslashes can be listed literally and do not need to be escaped. If your reference contains a space, or if you want to list multiple references in the section header, you should quote each reference.\*(in a distinguished name) use only in the canonical name, or CN, portion. (Why are asterisks escaped for wildcards in DNs/ADUC references?)
Notes
This section may be repeated as many times as needed.Multiple OUs in the same section header should be quoted with double quotes.
More information on an escaped asterisk "\*" as a wildcard
A distinguished name (DN) doesn't support any wildcards (see RFC1779 for the relevant specification). Martinet aims to be easy for IT novices and non-programmers to use, so it's up to Martinet to provide an easy way to indicate multiple DNs which doesn't conflict with the normal DN syntax.
Since one can put asterisks in an OU name, Martinet OU section DNs must allow for DNs with literal asterisks while also using the familiar (and conceptually simple) asterisk wildcard syntax. An escaped asterisk has no special meaning in RFC1779, so the compromise of an escaped asterisk as a wildcard is the simplest way to meet Martinet's need for an asterisk wildcard.
Suggested minimal permissions
Read-only permission in AD is recommended. If you intend to read OUs that aren't normally available to an AD user account, you will also need to grant your Martinet service account permission to read those OUs.Adding the service account user ACE might be sufficient to grant the minimum needed permissions. It's easy to grant the Martinet service account read-only permission because that is the default permission granted when adding a new security ACE to an OU.
Example sections
# OU references (DN, ADUC) without wildcards. [ou:OU=Groups,OU=MyUnit,OU=Urbana,DC=ad,DC=uillinois,DC=edu]
[ou:ad.uillinois.edu/Urbana/MyUnit/Groups]
# Distinguished name will expand to the DNs of all sub-OUs of OU=MyUnit,OU=Urbana,DC=ad,DC=uillinois,DC=edu. [ou:OU=\*,OU=MyUnit,OU=Urbana,DC=ad,DC=uillinois,DC=edu]
# Distinguished name will expand to the DNs of all sub-OUs of OU=MyUnit,OU=Urbana,DC=ad,DC=uillinois,DC=edu whose names start with "Grou". [ou:OU=Grou\*,OU=MyUnit,OU=Urbana,DC=ad,DC=uillinois,DC=edu]
# Distinguished name will expand to the DNs of all sub-OUs of # OU=MyUnit,OU=Urbana,DC=ad,DC=uillinois,DC=edu whose names # end with " staff" (the leading space before 'staff' means that # we need to quote the OU). [ou:"OU=\* staff,OU=MyUnit,OU=Urbana,DC=ad,DC=uillinois,DC=edu"]
# Distinguished name is the single sub-OUs of OU=MyUnit,OU=Urbana,DC=ad,DC=uillinois,DC=edu named "*". [ou:OU=*,OU=MyUnit,OU=Urbana,DC=ad,DC=uillinois,DC=edu]
# ADUC reference is the Active Directory Users & Computers snap-in syntax for OU=\*,OU=MyUnit,OU=Urbana,DC=ad,DC=uillinois,DC=edu DN. [ou:ad.uillinois.edu/Urbana/MyUnit/foo/bar/\*]