Hi Philip + Michael,
Try out the filter (ou:dn:=sales)
ok, that works, many thanks for your advice.
entryDN is of LDAP syntax Distinguished Name (1.3.6.1.4.1.1466.115.121.1.12) for which substring matching does not work just like for Directory String. Look into the server's subschema subentry to find the applicable matching rules.
Ok, in "newbie-speak" ;-) that means that there are certain objects in the DIT that don't accept wildcards in filters, right? I must admit that I haven't understood (yet) why that is and how I can tell if an object supports it or not. Can you point me to some kind of documentation where this is explained?
Thanks alot for your help!
Cheers -- Markus