Thanks Josh,
This helped me as well with a Lexmark x945e. I find that Lexmark's interface is slightly confusing, but anyhow, on top of your comments I wanted to clarify that distinguished name in my case with Exchange 2007 is the same as Display Name of the account I created for this function. I found this in the LDAP Authentication Setup -> MFP Credentials. Aside from putting in my server IP, I left the rest of the LDAP Authentication Setup default and it worked.
> On Friday, July 11, 2008 5:26 PM Bharat Suneja [MSFT] wrote:
> Is your Exchange Server a DC?
> Try pointing the printer to a DC.
> --
> Bharat Suneja
> Microsoft Corporation
> blog: exchangepedia.com/blog
>
> This posting is provided "AS IS" with no warranties, and confers no
> rights. Please do not send email directly to this alias. This alias is for
> newsgroup purposes only.
> ----------------------------
>
>
>
>
> "Josh Nikle" <jnikle@gmail.com> wrote in message
> news:18deddc7-0bc4-41dc-a6f0-5545c9e6342c@z72g2000hsb.googlegroups.com...
>> On Friday, July 11, 2008 11:17 PM John Fullbright wrote:
>> GC on port 3268 (TCP) for the GC partition (a view of the GAL). DC on 389
>> (TCP) for the domain partition (a view of domain accounts). It's not
>> necessarially the same thing. Sorry Bharat ;-)
>>
>> John
>>
>>
>> "Bharat Suneja [MSFT]" <bsuneja@online.microsoft.com> wrote in message
>> news:uOjr$y54IHA.2060@TK2MSFTNGP02.phx.gbl...
>>> On Saturday, July 12, 2008 3:56 AM Bharat Suneja [MSFT] wrote:
>>> No worries - whatever it takes to get it working. :)
>>> (Although it depends on the environment - in a single domain, DC works as
>>> well... )
>>> --
>>> Bharat Suneja
>>> Microsoft Corporation
>>> blog: exchangepedia.com/blog
>>>
>>> This posting is provided "AS IS" with no warranties, and confers no
>>> rights. Please do not send email directly to this alias. This alias is for
>>> newsgroup purposes only.
>>> ------------------------------------------
>>>
>>>
>>> "John Fullbright" <fjohn@donotspamnetappdotcom> wrote in message
>>> news:uDfDh384IHA.5012@TK2MSFTNGP05.phx.gbl...
>>>> On Monday, July 14, 2008 6:18 AM Josh Nikle wrote:
>>>> I recently got a Lexmark X642E printer and am trying to configure LDAP
>>>> on it to read our Exchange 2003 GAL. Their documentation is
>>>> worthless, and I'm a complete novice in regards to LDAP. Basically, I
>>>> have it able to contact my mail server, but my query keeps returning
>>>> no results. I'm wondering if there's some tool I can use to get what
>>>> parameters would work to return my GAL entries?
>>>>
>>>> Here's what I have so far:
>>>>
>>>> Search Base: DC=MYDOMAIN,DC=ORG (also tried
>>>> OU=MyCity,OU=Users,DC=MyD,DC=ORG)
>>>> UserID Attribute: userid=MyName (also tried CN=MyFirst MyLast)
>>>> Mail Attribute: mailnickname=*
>>>>
>>>> I can test this connection, and here's what I get:
>>>> LDAP CONNECTION ATTEMPT: SUCCESS
>>>> LDAP AUTHENTICATION SETTINGS ERROR: No results were found in the
>>>> specified Object Classes with the specified Userid Attribute.
>>>> LDAP ADDRESS BOOK SETTINGS ERROR: No results were found in the
>>>> specified Object Classes with the specified Search Attributes.
>>>>
>>>> I'm not expecting anyone to recognize these errors necessarily, but
>>>> I'm hoping that they give some clue as to what I'm supposed to do.
>>>> They seem to be telling me that my query returned nothing, but I don't
>>>> know. Also, if this is the wrong forum, please let me know. Thanks
>>>> much for any suggestions.
>>>>
>>>> -Josh
>>>>> On Monday, July 14, 2008 2:50 PM Massimo wrote:
>>>>> "Josh Nikle" <jnikle@gmail.com> ha scritto nel messaggio
>>>>> news:23517e35-c14d-42aa-b5b1-6f9cff579a81@79g2000hsk.googlegroups.com...
>>>>>
>>>>>
>>>>> That's quite difficult, a DC just can't stay unused too long :-)
>>>>>
>>>>>
>>>>> That would be good, but you can't demote a domain controller when Exchange
>>>>> is installed on it; it's going to remain that way, unless you can uninstall
>>>>> Exchange.
>>>>>
>>>>>
>>>>> There isn't a "UserID" attribute in Active Directory user objects, so your
>>>>> query is definitely doomed to failure.
>>>>> My question is: what are you trying to obtain? I think your printer wants to
>>>>> read user IDs and mail aliases of your users (altough I'm unable to guess
>>>>> what could a printer want to do with them), and it's asking you what
>>>>> attributes should it look for, as it can probably query other LDAP directory
>>>>> services too. So you basically should tell it where user IDs and mail
>>>>> aliases are defined in this directory schema.
>>>>>
>>>>> The Exchange alias is stored in the "mailNickName" attribute, so you're
>>>>> (almost) right here, if you keep proper casing (better to). Finding the
>>>>> username is a little more difficult, as there are several ones around, but
>>>>> the thing most similar to a user name is the "sAMAccountName" attribute,
>>>>> which is the user's Windows logon name (stripped of the domain part); you
>>>>> can also look for the userPrincipalName (user@domain.org).
>>>>>
>>>>> So your search filter should query the sAMAccountName and mailNickName
>>>>> attributes, using an asterisk for finding any entry or specific values if
>>>>> you want to match only some of them; the search base is ok, you can look at
>>>>> the entire domain or at a specific OU.
>>>>>
>>>>> You other query (based on the CN) failed because the CN of an object must
>>>>> always include the whole LDAP path, so a valid CN would be comething like
>>>>> "CN=MyFirst MyLast,OU=SomeOU,OU=SomeOtherOU,DC=domain,DC=org".
>>>>>
>>>>>
>>>>> Correct, everyone can query an Active Directory domain controller using LDAP
>>>>> (providing proper authentication, of course).
>>>>>
>>>>>
>>>>> Massimo
>>>>>> On Monday, July 14, 2008 5:02 PM Massimo wrote:
>>>>>> "Massimo" <barone@mclink.it> ha scritto nel messaggio
>>>>>> news:e2DZQKe5IHA.1428@TK2MSFTNGP06.phx.gbl...
>>>>>>
>>>>>>
>>>>>> By the way, based on what you posted, I think you should give the printer
>>>>>> only the attribute name, and not a full LDAP filter; i.e., "sAMAccountName"
>>>>>> and "mailNickName", not "sAMAccountName=SomeOne" and "mailNickName=*"; it
>>>>>> doesn't look like it wants to put it directly into a query, but only to know
>>>>>> the right attributes to use.
>>>>>> But I can't tell for sure, without looking at the printer manual.
>>>>>>
>>>>>>
>>>>>> Massimo
>>>>>>> On Monday, July 14, 2008 8:24 PM Rich Matheisen [MVP] wrote:
>>>>>>> On Mon, 14 Jul 2008 06:28:29 -0700 (PDT), Josh Nikle
>>>>>>> <jnikle@gmail.com> wrote:
>>>>>>>
>>>>>>>
>>>>>>> If you've installed Exchange on a DC you have no choice but to use it.
>>>>>>> In fact, Exchange won't use any other GC.
>>>>>>>
>>>>>>>
>>>>>>> You can't.
>>>>>>>
>>>>>>>
>>>>>>> That's right.
>>>>>>>
>>>>>>> "Search Base: DC=MYDOMAIN,DC=ORG (also tried
>>>>>>> OU=MyCity,OU=Users,DC=MyD,DC=ORG)
>>>>>>> UserID Attribute: userid=MyName (also tried CN=MyFirst MyLast)
>>>>>>> Mail Attribute: mailnickname=*
>>>>>>>
>>>>>>> I can test this connection, and here's what I get:
>>>>>>> LDAP CONNECTION ATTEMPT: SUCCESS
>>>>>>> LDAP AUTHENTICATION SETTINGS ERROR: No results were found in the
>>>>>>> specified Object Classes with the specified Userid Attribute.
>>>>>>> LDAP ADDRESS BOOK SETTINGS ERROR: No results were found in the
>>>>>>> specified Object Classes with the specified Search Attributes."
>>>>>>>
>>>>>>> The error mentioned "specified Object Classes" but I don't see any of
>>>>>>> those in the information you provided.
>>>>>>>
>>>>>>>
>>>>>>> Well, no . . . it wouldn't do that. If it did there'd only be one user
>>>>>>> in the GAL!
>>>>>>>
>>>>>>>
>>>>>>> Port 389 is (that's the DC). So is 3268 (the GC).
>>>>>>>
>>>>>>>
>>>>>>> You're not dealing with any "GAL", you're querying the Active
>>>>>>> Directory. The GAL is really accessed by using the NSPI (Name Service
>>>>>>> Provider Interface), and you don't need any of what that does.
>>>>>>>
>>>>>>>
>>>>>>> Are you looking for just one user?
>>>>>>>
>>>>>>> (&(objectclass=user)(objectcategory=person)(cn=<CN of the user))
>>>>>>>
>>>>>>> If you want ALL the users:
>>>>>>>
>>>>>>> (&(objectclass=user)(objectcategory=person))
>>>>>>>
>>>>>>> Where you start the search in the AD hierarchy is the "Search Base".
>>>>>>> That's usually going to depend on the way your search is conducted. If
>>>>>>> it's a "subtree" search scope you can start at the domain
>>>>>>> (DC=MYDOMAIN,DC=ORG). If the scope is "onelevel" you're only looking
>>>>>>> in one container and none of the child containers will be searched, so
>>>>>>> the base would be the OU you want to look in
>>>>>>> (OU=MyCity,OU=Users,DC=MYDOMAIN,DC=ORG).
>>>>>>> ---
>>>>>>> Rich Matheisen
>>>>>>> MCSE+I, Exchange MVP
>>>>>>>> On Tuesday, July 15, 2008 2:17 PM Massimo wrote:
>>>>>>>> "Josh Nikle" <jnikle@gmail.com> ha scritto nel messaggio
>>>>>>>> news:a415ec18-3557-4959-93fa-3ed5377a5040@d45g2000hsc.googlegroups.com...
>>>>>>>>
>>>>>>>>
>>>>>>>> This couldn't have worked, because object classes define what kind of object
>>>>>>>> should the query look for in Active Directory, not the attribute names; you
>>>>>>>> should put "user" there, as this is the object class of user objects.
>>>>>>>>
>>>>>>>>
>>>>>>>> Based on what I understood of it, you should put "sAMAccountName" here; but
>>>>>>>> I can't know for sure.
>>>>>>>>
>>>>>>>> Try putting in "user" (or "person") as the object class definition,
>>>>>>>> "sAMAccountName" as the UserID attribute and "mailNickName" as the Mail
>>>>>>>> Attribute, and then testing your connection. What does it do?
>>>>>>>>
>>>>>>>> Also: where do you tell the printer the server name (or IP address) of your
>>>>>>>> LDAP server? You didn't mention this, and the printer should obviously know
>>>>>>>> which server to query; you should put a domain controller name (or IP
>>>>>>>> address) there.
>>>>>>>>
>>>>>>>>
>>>>>>>> Massimo
>>>>>>>>> On Thursday, July 17, 2008 11:23 PM Josh Nikle wrote:
>>>>>>>>> Thanks for the replies. You guys lost me a little bit though. My
>>>>>>>>> Exchange server is a DC, although I don't use it as one. I inherited
>>>>>>>>> it that way and was under the impression I should get the domain
>>>>>>>>> services off of it. Anyway, I assume those error messages are telling
>>>>>>>>> me my query returned no results due to that parameter, right? I
>>>>>>>>> looked at the query that produces the GAL in the Outlook client
>>>>>>>>> itself, but I didn't see anything regarding a UserID or any such
>>>>>>>>> parameter. LDAP is set up automatically with Sever 2003, correct? I
>>>>>>>>> don't need to "share" my GAL or something? As to my original
>>>>>>>>> question, is there any place in Exchange/Outlook I can go to to see
>>>>>>>>> how I should phrase my query? Thanks again for your help.
>>>>>>>>>
>>>>>>>>> -Josh
>>>>>>>>>> On Thursday, July 17, 2008 11:24 PM Josh Nikle wrote:
>>>>>>>>>> Thanks for the info. I'm new to AD too, so that probably isn't
>>>>>>>>>> helping.
>>>>>>>>>>
>>>>>>>>>> Anyway, all I'm trying to do is set up scan to email capability on the
>>>>>>>>>> printer. Typing in the address works fine, so at least I know I have
>>>>>>>>>> all that configured correctly. I just want to get the printer to
>>>>>>>>>> access my global address list and return everything that's in there.
>>>>>>>>>>
>>>>>>>>>> I tried your suggestions with no success. As to your mention of the
>>>>>>>>>> manual, I found it to be worthless. Tech support was the same. They
>>>>>>>>>> both tell me how to get to the config screen and then to "enter the
>>>>>>>>>> correct information." If I knew that, I wouldn't need either,
>>>>>>>>>> right? :)
>>>>>>>>>>
>>>>>>>>>> I'm not sure what to try from here. The errors just aren't specific
>>>>>>>>>> enough to tell me much more than that my query failed. I can list the
>>>>>>>>>> fields on the config screen if that would be helpful. There is also a
>>>>>>>>>> screen for "Search specific object classes" in which I added both
>>>>>>>>>> "sAMAccountName" and "userPrincipalName" just to try, but still
>>>>>>>>>> nothing. The only other thing about the LDAP config screen I can tell
>>>>>>>>>> you is that next to the UserID field, it says "Enter either cn, uid,
>>>>>>>>>> userid or user-defined." Don't know if that means anything at all.
>>>>>>>>>>
>>>>>>>>>> Again, thanks for your help and info.
>>>>>>>>>>
>>>>>>>>>> -Josh
>>>>>>>>>>> On Thursday, July 17, 2008 11:26 PM Josh Nikle wrote:
>>>>>>>>>>> ect
>>>>>>>>>>> ou
>>>>>>>>>>>
>>>>>>>>>>> OK. Thanks. I didn't think so, but I'm desperate.
>>>>>>>>>>>
>>>>>>>>>>> ut
>>>>>>>>>>> ur
>>>>>>>>>>> ow
>>>>>>>>>>>
>>>>>>>>>>> OK. Tried that. Still getting the same errors. I'm telling the
>>>>>>>>>>> printer to look at my primary domain controller, and I do that in the
>>>>>>>>>>> same screen I'm entering the userid and mail attributes. At this
>>>>>>>>>>> point I wonder if I should try calling their tech support now that I'm
>>>>>>>>>>> a little less clueless and see if I can get any more info.
>>>>>>>>>>>
>>>>>>>>>>> Thanks again for all your help. If you have any other ideas, I'm
>>>>>>>>>>> open. Or if you think of any questions it would be good to ask their
>>>>>>>>>>> tech support, I'll certainly do that. Thanks again.
>>>>>>>>>>>
>>>>>>>>>>> -Josh
>>>>>>>>>>>> On Sunday, July 20, 2008 3:33 AM Josh Nikle wrote:
>>>>>>>>>>>> Figured it out. I had anonymous bind checked, and apparently AD
>>>>>>>>>>>> doesn't let you browse beyond the root with that. I ended up using
>>>>>>>>>>>> LDAP Browser and found that little tidbit in its help menu. I just
>>>>>>>>>>>> had to uncheck that and then enter the distinguished name of an
>>>>>>>>>>>> account I set up for these printers in AD, and presto. Thanks again
>>>>>>>>>>>> all of you for your help. Never would have found the solution without
>>>>>>>>>>>> Googling the terms I picked up from your posts.
>>>>>>>>>>>>
>>>>>>>>>>>> -Josh