Configuring Active Directory (LDAP) Access Using a Security Group

-----------------------------------

Affected Roles: Administrator

Related DW Software: DW Spectrum

Last Edit: September 23, 2026

-----------------------------------

Active Directory Overview

DW Spectrum can import users from Active Directory (AD) over LDAP. This article shows how to limit that import to members of one AD security group, so VMS access is granted or removed simply by adding or removing people from that group.

This article will outline:

• Building the recommended OU and security group structure in AD
• Creating a read-only service account for DW Spectrum
• Testing the connection from the Media Server before configuring the VMS
• Connecting DW Spectrum, filtering by group, and importing users
• Fixing the most common problems

Example Values Used in this Article

Replace these with the values for own domain everywhere they appear.

An LDAP name (DN) is read from right to left, from the domain inward. For example, CN=DWSpectrum-Users,OU=VMS,OU=Groups,DC=example,DC=com means the group DWSpectrum-Users, inside the OU VMS, inside the OU Groups, in the domain example.com.

Recommended AD Structure

• OUs are folders. They organize objects and control where Group Policy applies. An OU cannot be a member of a group, and a group cannot contain an OU.
• Security groups are membership lists. DW Spectrum uses group membership to decide who to import.
• User accounts can stay where they are. DW Spectrum finds users through their membership in the group, not their location in AD.

Nested OUs Are Supported

A nested OU is an OU placed inside another OU, like a folder inside a folder. In this article, VMS is nested inside Groups:

example.com
└── OU: Groups          ← parent OU
    └── OU: VMS         ← nested (child) OU
        └── DWSpectrum-Users (security group)

DW Spectrum works with nested OUs of any depth. Keep these points in mind:

• Search base covers everything below it.

DW Spectrum searches the OU set as the search base and every OU nested beneath it. For example, a search base of OU=Staff,DC=example,DC=com also finds users in OU=Security,OU=Staff,DC=example,DC=com.

• Group DNs list every OU, innermost first.

A group in Groups VMS has the DN CN=DWSpectrum-Users,OU=VMS,OU=Groups,DC=example,DC=com. If the OU order in the filter is reversed or misspelled, no users are imported.

• User OUs don’t need to match the group’s OU.
• Users can sit in any OU, nested or not, if the search base covers their location and they are members of the group.

Nested OUs vs nested groups: A nested group is a group that is a member of another group. Nested OUs need no special setup, but nested groups need the nested-group filter in Step 5.

Requirements

NOTE: The LDAP connection is made by the Media Server, not by the workstation running the Desktop Client. Run all tests in this article on the Media Server.

Step 1: Create the OUs and Security Group

Create the objects from the outside in: the top-level OU, then the sub-OU, then the group.

Using Active Directory Users and Computers

1. On a domain controller, open Active Directory Users and Computers.
2. Right-click the domain à New à Organizational Unit à name it “Groups”.
3. Right-click Groups à New à Organizational Unit à name it “VMS”.
4. Right-click VMS à New à Group à name it “DWSpectrum-Users” and set the following:
   • Group Scope: Global
   • Group Type: Security
5. Open DWSpectrum-Users à Members tab à Add, then add the users who need DW Spectrum access.

Using PowerShell (on a domain controller)

New-ADOrganizationalUnit -Name "Groups" -Path "DC=example,DC=com"
New-ADOrganizationalUnit -Name "VMS" -Path "OU=Groups,DC=example,DC=com"
New-ADGroup -Name "DWSpectrum-Users" -GroupScope Global -GroupCategory Security -Path "OU=VMS,OU=Groups,DC=example,DC=com"
Add-ADGroupMember "DWSpectrum-Users" -Members jsmith,mjones

The group’s DN, used later in the DW Spectrum filter, is:

CN=DWSpectrum-Users,OU=VMS,OU=Groups,DC=example,DC=com

IMPORTANT: Do not set DWSpectrum-Users as any user’s primary group. AD does not list a user’s primary group in the memberOf attribute, so the filter will not find that user. Leave Domain Users as the primary group.

Step 2: Create a Service Account

DW Spectrum needs an AD account to read the directory. Use a dedicated standard user, not a Domain Admin account.

1. Create a user named svc-dwspectrum. Standard domain users can read the directory by default; no extra rights are required.
2. Set Password never expires, or track its expiration date. If the password expires or changes, LDAP sync and LDAP logins stop working until it is updated in DW Spectrum.
3. Do not add this account to DWSpectrum-Users unless it should also be a VMS user.

New-ADUser -Name "svc-dwspectrum" -SamAccountName "svc-dwspectrum" -UserPrincipalName "svc-dwspectrum@example.com" -Path "CN=Users,DC=example,DC=com" -AccountPassword (Read-Host -AsSecureString "Password") -Enabled $true -PasswordNeverExpires $true

The login can be entered in DW Spectrum as either:

• CN=svc-dwspectrum,CN=Users,DC=example,DC=com (full DN)
• svc-dwspectrum@example.com (UPN)

Step 3: Test from the Media Server

These three tests take a few minutes and show whether a problem is in the network, in AD, or in DW Spectrum. They use built-in Windows tools only. Open PowerShell on the Media Server (not Command Prompt).

1. Network: can the Media Server reach the domain controller?

Test-NetConnection dc01.example.com -Port 389

TcpTestSucceeded : True means the port is reachable. False means a firewall, VLAN or routing issue is blocking it.

2. AD: does the service account log in, and is a test user in the group?

$e = New-Object DirectoryServices.DirectoryEntry('LDAP://dc01.example.com/DC=example,DC=com','svc-dwspectrum@example.com','ServiceAccountPassword')
$s = New-Object DirectoryServices.DirectorySearcher($e,'(sAMAccountName=jsmith)')
$r = $s.FindOne(); $r.Properties['distinguishedname']; $r.Properties['primarygroupid']; $r.Properties['memberof']

Check that:

• The memberof list includes CN=DWSpectrum-Users,OU=VMS,OU=Groups,DC=example,DC=com.
• primarygroupid is 513 (Domain Users).

“The user name or password is incorrect” means the service account credentials are wrong.

3. Filter: does the exact DW Spectrum filter return the right users?

$s.Filter = '(memberOf=CN=DWSpectrum-Users,OU=VMS,OU=Groups,DC=example,DC=com)'
$s.FindAll() | ForEach-Object { $_.Properties['samaccountname'] }

Every member of DWSpectrum-Users should be listed. If so, AD is configured correctly.

Close PowerShell when finished so the password does not remain in the session history.

Step 4: Connect DW Spectrum to Active Directory

1. In the DW Spectrum Desktop Client, open Site Administration (CTRL + ALT +A) Users LDAP, and open the connection settings.
2. Enter the following:

3. Click Test. When the test succeeds, click OK.

About StartTLS: Many domain controllers, including Windows Server 2025 by default, reject unencrypted logins on Port 389. If Test fails but Step 3 passed, enable Use StartTLS. StartTLS requires a certificate on the domain controller, typically issued by AD Certificate Services. For production, install the issuing CA certificate on the Media Server and turn off Ignore LDAP server certificate errors.

TIP: Make sure the Host field contains only the hostname or address. Any extra characters make the host invalid and the test fails with “Cannot connect to LDAP server.”

Step 5: Set the Search Base and Group Filter

The search base tells DW Spectrum where to look for users. The filter decides which users to import.

1. In the LDAP settings, add a search base with the values above.
2. Paste the filter exactly as shown, including the outer parentheses. The group DN must match AD character for character: OU order, spelling and plurals all matter.
3. Click Fetch / Sync users to import immediately. DW Spectrum also syncs automatically about every 10 minutes.
4. Confirm the imported users match the list from test 3c.

If the domain root is not accepted as a search base, use the container or OU that holds the user accounts, such as CN=Users,DC=example,DC=com, and keep the same filter.

Nested groups: The filter above matches direct members only. If other groups are nested inside DWSpectrum-Users, use:

(memberOf:1.2.840.113556.1.4.1941:=CN=DWSpectrum-Users,OU=VMS,OU=Groups,DC=example,DC=com)

More than one group: To import members of several groups, combine them with | (OR):

(|(memberOf=CN=DWSpectrum-Admins,OU=VMS,OU=Groups,DC=example,DC=com)(memberOf=CN=DWSpectrum-Viewers,OU=VMS,OU=Groups,DC=example,DC=com))

Step 6: Enable Users and Assign Permissions

1. Go to Site Administration → Users. Imported LDAP users are listed with their AD usernames.
2. Enable each user who should have access.
3. Assign each user a role or user group (for example, Viewer, Advanced Viewer, Power User, or a custom role).
4. Log in to the Desktop Client as an imported user with their normal AD username and password to confirm access.

Good to Know

• LDAP users must log in to the Desktop Client at least once before they can use the Web Client.
• DW Spectrum does not store LDAP passwords. Each login is checked against AD.
• To remove access, remove the user from DWSpectrum-Users in AD. After the next sync, confirm the user shows as disabled in DW Spectrum, and disable them manually if needed.

Troubleshooting

If all Step 3 tests pass but DW Spectrum still fails, set the Media Server logging level to DEBUG2 (Verbose), repeat the action, download the server logs, and send them to DW Technical Support.

Quick Reference

Related Articles

• DW Spectrum - Integrate and Configure an LDAP Server
• DW Spectrum - LDAP Troubleshooting Guide & FAQs

______________________________________________________________________________

For More Information or Technical Support

DW Technical Support: https://www.digital-watchdog.com/contact-tech-support/

DW Sales: sales@digital-watchdog.com| www.digital-watchdog.com

Copyright © All rights reserved. Specifications and pricing subject to change without notice.