Known Issue: Deselecting an OU for import also unchecks the OU immediately above it

Article:TECH178704  |  Created: 2012-01-11  |  Updated: 2012-10-09  |  Article URL
NOTE: If you are experiencing this particular known issue, we recommend that you Subscribe to receive email notification each time this article is updated. Subscribers will be the first to learn about any releases, status changes, workarounds or decisions made.
Article Type
Technical Solution


Cannot select an upper level OU without all sub OUs being automatically checked. Also, cannot uncheck a lower level OU without unchecking the OU right above it.

So in the case of:

If you want to import users from OU2 but not OU3 you cannot check OU2 without OU3 also being checked automatically. Unchecking OU3 also automatically unchecks OU2.
Note: if there was an OU4 then unchecking it would uncheck OU3 but not OU2.


This issue only appears in ServiceDesk 7.1 sp2.


This issue is addressed in Workflow 7.1 SP2 MP2, Workflow 7.5 and newer (and the ServiceDesk versions based on these).

As a workaround, use LDAP user query:

  1. Open the ServiceDesk ProcessManager.
  2. Go to Admin > Active Directory > Sync Profiles.
  3. Click the action icon for the profile you want to use and click Edit AD Sync Profile.
  4. Click Next.
  5. Select the Specify LDAP Queries radio button.
  6. Click the LDAP Query List User button.
  7. The default entry will be in the form “LDAP://<OU to import,DC=domain,DC=com” modify this with the specific OU ‘and any/all parent OU’s’.
    For example  LDAP://,OU=parentOU,OU=nextparentOU,DC=domain,DC=com.
Note: Replace ADserver with the ADserver FQDN, baseOU with the OU you want to import users from, remove or add parent OU's from base to top and change domain to your domain.

Supplemental Materials


When editing or creating AD Sync Profiles, you cannot deselect a Child OU without also deselecting the Parent OU.

Article URL

Terms of use for this information are found in Legal Notices