IdFix gives blank result when filtering to a single OU

[IT-Wheel]

Thank you for reporting an issue, suggesting an enhancement, or asking a question. We appreciate your feedback - to help the team understand your
needs please complete the below template to ensure we have the details to help. Thanks!

Please check out the Docs to see if your question is already addressed there. This will help us ensure our documentation covers the most frequent questions.

If you are reporting a security related issue, instead of submitting it here, please email secure@microsoft.com to ensure it is properly handled to resolution.

Category

• Enhancement
• Bug
• Question
• Documentation gap/issue

Version

Please specify what version of IdFix you are using: 2.6.0.2

If you are not using the latest release, please update and see if the issue is resolved before submitting an issue.

Expected / Desired Behavior / Question

I would like to filter IdFix to a single OU (OU=The Name Co,DC=tnc,DC=local) and see it return all the invalid objects in the OU I want to replicate that I see when I do not filter.

Observed Behavior

When I query using the defaults, all of the results come through and I see several invalid objects in the OU I want to filter on. I am having a problem filtering idfix to a single OU (OU=The Name Co,DC=tnc,DC=local) and its sub-OUs. When I query using the filter there are no results.

Steps to Reproduce

Run IdFix query after updating the filter variables. All are default except 'Filter:' containing 'OU=The Name Co,DC=tnc,DC=local' (without quotes). When I click query there are no results.

Suggestion: Add a dialog to select the OU from active directory VIA GUI to filter on rather than text. This would avoid the issue of getting the text wrong.

[IT-Wheel]

You
I am having a problem filtering idfix to a single OU (OU=The Name Co,DC=tnc,DC=local) and it's sub-OUs, but when I query the results are blank
Copilot
I’m sorry to hear that you’re having trouble with IdFix. When you’re using IdFix to query a specific Organizational Unit (OU) and its sub-OUs in Active Directory, you need to specify the distinguishedName of the OU1.

In your case, you should enter the value in the format OU=The Name Co,DC=tnc,DC=local2. If you’ve done this and are still getting blank results, it could be due to one of the following reasons:

There might not be any invalid attributes within the specified OU and its sub-OUs.
The user account you’re using to run IdFix might not have the necessary permissions to read the attributes of the objects within the specified OU.
If you’re sure there are objects with invalid attributes and you have the necessary permissions, you might want to try running IdFix again. If the problem persists, please provide more details so I can assist you better. 😊

You
Please tell me more about the filtering format in IdFix. Is 'OU=The Name Co,DC=tnc,DC=local' a valid filter?
Copilot
Yes, the filter ‘OU=The Name Co,DC=tnc,DC=local’ is a valid filter in IdFix. In IdFix, the filter value must be entered in the format OU=The Name Co,DC=tnc,DC=local1. This is known as the distinguishedName of the Organizational Unit (OU) in Active Directory1.

When you enter this value and select Query, IdFix will query for objects containing invalid attributes that will cause directory synchronization errors1. The scope of the query can be limited by entering a valid directory path in the Filter field to use as a start for the subtree search1.

Please note that only one starting point can be designated at a time2. The subtree point will be used for all successive queries until changed2. Deleting the value will reset the query to the whole forest1.

So, if you want to filter the query to the OU The Name Co’ and its sub-OUs in your domain ‘tnc.local’, you would enter ‘OU=The Name Co,DC=tnc,DC=local’ as the filter1. If a blank DataGrid is displayed after execution, then no errors were returned1, which means there are no invalid attributes within the specified OU and its sub-OUs that would cause directory synchronization errors3. 😊

You
Show me some examples of the text you would add to the IDFIX filter to include only a single OU and it's sub OUs.
Copilot
Sure, here are some examples of how you might specify an Organizational Unit (OU) and its sub-OUs in the IdFix filter. Remember, the format is OU=YourOU,DC=YourDomain,DC=com:

If you have an OU named “Marketing” in a domain named “contoso.com”, you would enter:
OU=Marketing,DC=contoso,DC=com
If you have an OU named “Sales” under a parent OU named “Departments” in a domain named “fabrikam.com”, you would enter:
OU=Sales,OU=Departments,DC=fabrikam,DC=com
If you have an OU named “HR” under a parent OU named “UK” under another parent OU named “Europe” in a domain named “adventure-works.com”, you would enter:
OU=HR,OU=UK,OU=Europe,DC=adventure-works,DC=com
Please replace “YourOU”, “YourDomain”, and “com” with your actual OU name and domain information. The DC (Domain Component) part of the distinguishedName should match your domain’s Fully Qualified Domain Name (FQDN). 😊

You
What if there is a space in the name of the OU?
Copilot
If there is a space in the name of the Organizational Unit (OU), you can still include it in the filter in IdFix. Just make sure to include the space in the OU name. For example, if you have an OU named “Human Resources” in a domain named “contoso.com”, you would enter:

OU=Human Resources,DC=contoso,DC=com
Spaces and other special characters are allowed in OU names in Active Directory, and they should be included as is when specifying the OU in tools like IdFix. 😊

You
Why does my OU filtered IdFix query blank?
Copilot
If your IdFix query is returning blank results, it could be due to one of the following reasons:

No Invalid Attributes: There might not be any invalid attributes within the specified Organizational Unit (OU) and its sub-OUs1. IdFix queries all objects with a filter for applicable attributes1. If a blank DataGrid is displayed after execution, then no errors were returned1. This is a good thing1.
Insufficient Permissions: The user account you’re using to run IdFix might not have the necessary permissions to read the attributes of the objects within the specified OU2. You need to have read/write access to your on-premises Active Directory objects to use IdFix2.
Incorrect Filter Format: The filter value must be entered in the format OU=myOu,DC=Contoso,DC=com1. If there is a space in the name of the OU, include the space in the OU name2. Only one starting point can be designated at a time1. The subtree point will be used for all successive queries until changed1. Deleting the value will reset the query to the whole forest1.
If you’ve checked all of these and are still getting blank results, you might want to try running IdFix again. If the problem persists, please provide more details so I can assist you better. 😊

You
I have used the proper filter format for specifying the OU in IdFix where there are multiple invalid attributes but the query is still blank. What did I do wrong? The default query returns hundreds of objects in this OU and its sub-OUs
Copilot
I’m sorry to hear that you’re still having trouble with IdFix. If you’re sure that you’ve entered the filter in the correct format and there are indeed objects with invalid attributes within the specified OU and its sub-OUs, then it’s quite unusual for the query to return blank results1.

Here are a few things you might want to check:

Permissions: Make sure the account you’re using to run IdFix has read/write permissions to your on-premises Active Directory objects2. You need these permissions to use IdFix2.
IdFix Version: Ensure you’re using the latest version of IdFix. Older versions might have bugs or compatibility issues that have been resolved in newer releases2.
Rule Set: Check if you’re using the correct rule set in IdFix. By default, IdFix uses the Multi-Tenant rule set1. If you’re an Office 365 Dedicated customer, you should use the Dedicated rule set1.
Filter Format: Double-check the filter format. It should be in the format OU=myOu,DC=Contoso,DC=com1. Make sure there are no typos or extra spaces.
Active Directory Replication: Ensure that Active Directory replication is working correctly. If there are replication errors, IdFix might not be able to see the latest changes2.
If you’ve checked all of these and the problem persists, it might be a good idea to reach out to Microsoft Support for further assistance. They have access to more resources and can help troubleshoot the issue in more depth. 😊

[IT-Wheel]

I was putting it in the wrong field!