You can!!! In short use this as the connection string: ldap://<host>:3268/DC=<my>,DC=<domain>?cn together with your search filter, e.g. (&(sAMAccountName={0})(&((objectCategory=person)(objectclass=user)(mail=*)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(memberOf:1.2.840.113556.1.4.1941:=CN=<some-special-nested-group>,OU=<ou3>,OU=<ou2>,OU=<ou1>,DC=<dc3>,DC=<dc2>,DC=<dc1>)))) That will search in the so called Global Catalog, that had been available out-of-the-box in our environment. Instead of the known/common other versions (or combinations thereof) that did NOT work in our environment with multiple OUs: ldap://<host>/DC=<my>,DC=<domain> … Read more