Using the AD "custom Search" to evaluate.
Learned something new today !

supper Thanks!

I'd check that search base is wide enough.

(&(|(objectClass=user)(objectClass=group))(department=Department1))

you can even use wildcards there:

(&(|(objectClass=user)(objectClass=group))(department=Department*))

I have try it but i get not any users, do you have a example with a space in the string ?
my 2 treys are:

(&(|(objectClass=user)(objectClass=group))(department="Department ICT"))
(&(|(objectClass=user)(objectClass=group))(department=Department ICT))

I have no control over the naming of the department attribute

you can even use wildcards there:

(&(|(objectClass=user)(objectClass=group))(department=Department*))

I usually filter by the base group, but you need to use ActiveDirectory(?) extensions to do it recursively, something like this:

(&(|(objectClass=user)(objectClass=group))(memberOf:1.2.840.113556.1.4.1941:=CN=…))

Hi Thanks,

As a workaround i created a dedicated group in AD and use Your solution ;-).
Is there no documentation with the use of "Department" attribute in AD ?

(&(|(objectClass=user)(objectClass=group))(memberOf:1.2.840.113556.1.4.1941:=CN=…))