Find answers to common questions about configuring, managing, and securing LDAP integrations between Active Directory and the VMS Media Server. This guide covers supported network configurations, default port requirements, synchronization behavior, and account permissions.

How does the Media Server perform LDAP synchronization?

The Media Server uses standard LDAP queries to perform a simple search based on the Search Base configuration and filter logic defined in your settings.

What ports does LDAP use?

• Standard LDAP: 389

• Secure LDAP (LDAPS): 636

• Global Catalog (LDAP): 3268

• Global Catalog (LDAPS): 3269

Is it possible to pull users from across multiple domains using a Global Catalog?

Yes. To retrieve users from across trusted domains using a Global Catalog server, connect using the custom Global Catalog ports instead of standard ports:

• Use port 3268 for LDAP connections.

• Use port 3269 for LDAPS connections.

Using standard ports (389/636) only retrieves users local to that specific LDAP server's domain. Ensure your search bases are configured to account and filter for users across multiple domains.

How often does the VMS sync with the LDAP server?

The VMS automatically attempts to synchronize with the LDAP/Active Directory server once every 10 minutes by default. You can adjust this polling interval under Advanced Settings in the LDAP integration configuration within the desktop client.

How do I restrict sync to specific users instead of the entire directory?

Refine your Search Base Distinguished Name (DN) or add group filters:

• Filter by Organizational Unit (OU): If all users live in a specific OU, set the search base directly to that OU's DN path.

• Filter by Group Membership: If users span multiple OUs, set a higher-level search base (such as domain-level) and add a filter for the memberOf attribute.

Filter example:

memberOf=CN=Security Users,CN=Users,DC=DOMAIN,DC=LOCAL

Does the VMS store LDAP passwords?

No. For security reasons, the VMS never stores password data for LDAP accounts.

Does the LDAP Server need to be on the local network with the Media Server?

No. The LDAP Server must be reachable by the Media Server over LAN, WAN, or VPN. As long as network communication is established between both the Media Servers, and the LDAP Server, a local connection is not required.

Why is the LDAP setting button missing in the Desktop Client?

LDAP settings are unavailable to users logged into the Desktop Client using an LDAP account—even if assigned the Power User role. This prevents users from accidentally altering settings that could revoke their own connection permissions. To modify LDAP settings, log in using a local administrator account.

Why does LDAPS (LDAP over SSL) fail when standard LDAP works?

LDAPS uses encrypted communication that requires valid SSL/TLS certificates installed on both the LDAP server and the Media Server. Invalid or missing certificates are a common cause of failure.

To verify the issue:

1. Test your connection using standard LDAP (port 389).

2. If standard LDAP connects successfully, the failure is likely certificate-related.

3. Work with your LDAP administrator to verify and install the required certificates.

Why do some LDAP users show as "Invalid" in the VMS?

An LDAP user account displays an invalid status with the message Account could not be found in the database when the scheduled synchronization cannot locate the user in the configured search base.

This typically occurs if:

• The user was deleted from Active Directory.

• The user account or search base settings were changed (for example, removing the user from a filtered group or moving them outside the search base OU).

If the account still exists in Active Directory where expected, contact your reseller for technical support.

Does the Login DN need Domain Admin permissions to perform LDAP searches?

No. By default, any standard domain user account can query the LDAP server for Active Directory objects. Because the Media Server only queries data to populate its local database without modifying Active Directory, elevated permissions or Domain Admin rights are not required.

Related resources

• Having trouble connecting? See Troubleshoot LDAP connections for step-by-step diagnostic instructions and log collection steps.

• To filter specific Active Directory users or groups during synchronization, see Configuring LDAP Search Bases for Specific Groups and Users.