How to create a new LDAP device label (4306222)

It is possible to import LDAP labels during an LDAP import, however, it is unlikely that all labels imported would be utilized, thus filling up the LDAP label list with multiple unused queries.  It is possible to manually create necessary LDAP labels, but it is a multi-step process.  This article will go over creating an LDAP device label and provide an example when using a specific OU (Organizational Unit).

Search filters are environment specific.  For more information, please see: How to setup LDAP Authentication 

For more information on this topic, please see the KACE-SMA Course 3 Appliance Fundamentals-Web-based Training.

Creating an LDAP label requires multiple parts, each with its own steps.  The two main parts of creating an LDAP label are:

1. Creating a manual label (container)
2. Creating the LDAP filter (label) (LDAP Smart Label)

Creating a Manual Label (to be used in an LDAP label):

1. Go to Home | Label Management | Labels
2. Use Choose Action | New Manual Label
3. Name the label the exact name desired for the final LDAP Label
4. Add a description if desired (this will show in the LDAP label as well)
5. Ignore the Alternate Location (leave those fields blank)
6. Restrict Label Usage To (choose type of label being created) (for this example, check Device Inventory)
7. Click Save

Creating the LDAP Filter (Label):

1. Go to Home | Label Management | LDAP Labels
2. Use Choose Action | New

NOTE: The Enabled check box should not be chosen until the label is fully tested and the proper KACE variable has been added.  See information about the Advanced Search in step 8 below.

3. Choose Type (Device or User) (for this example, choose Device)
4. Use the Associated Label drop-down box to choose the manual label created in the steps above
5. Fill in the Server with IP or Hostname of the server
6. Fill in the port with either 389 or 636 for Secure LDAP (ldaps)
7. Fill in the Base DN
   1. The KACE SMA is recursive and will search every directory below the chosen Base DN.  (for this example, it could be: OU=,OrgazationalUnitNameWhereSystemsExist,DC=domain,DC=com, where the OU is the exact OU where the systems exist and domain.com is replaced with the actual domain)
   2. Example: OU=Texas Computers,DC=kace,DC=com
8. Fill in the Advanced Search (filter)
   1. An example device filter when pointing directly to the OU where the computers exist in the Base DN: (&(name=KBOX_COMPUTER_NAME)(objectcategory=computer))

NOTE: Filters are environment specific, but do require the proper KACE variable to apply properly.  Please see LDAP Filters Tips and Tricks for more information.

NOTE: Attempting to use Test in an LDAP Label Detail will fail if the KACE variable exists.  For testing, use an asterisk (*) where the KACE variable will go, and then once the filter is confirmed, change the asterisk (*) to the proper KACE variable.  Failing to change the asterisk to the proper KACE variable before enabling the LDAP label can cause the incorrect users / devices (or all users / devices) to be applied to the label.  For more information, please see Testing and Applying LDAP Labels

9. Fill in the Login
   1. ​username@domain
   2. domain\username
   3. Full Distinguished Name of the user
10. Fill in the Password
    1. Though read only rights are all that are necessary for these credentials, we suggest a password that never changes, or it will need to be updated on every label manually each time it changes.
11. Click Save

NOTE: LDAP device labels DO NOT apply to the devices immediately.  A test, when used with an asterisk, will show the computers that should apply, but the label will NOT be fully generated until the KACE variable has been saved in the label and each device has completed inventory (checked-in with the KACE SMA).  It will be necessary to wait until all desired devices have completed inventory and pick up the label before using it in a distribution.