2012/12/11 Philip Guenther <guenther+ldaptech@sendmail.com>
On Tue, 11 Dec 2012, Victor Sudakov wrote:
[...]
> If I wanted to reproduce the Outlook's incorrect request, what
> ldapsearch command line should that be?

Just leave out the explicit rule:
        ldapsearch -E sss=cn '(cn=*)' cn

-E '!sss=cn'
The requested extension is critical in the dump.

--
Erwann.