topic Re: GCDS Filter/Exception to OMIT a Single OU in Peer-Peer Topics

GCDS Filter/Exception to OMIT a Single OU

Justin_W — Tue, 05 May 2026 16:22:58 GMT

I'm trying to find the correct way to get this working, and so far I'm not having any luck. Gemini was in full hallucination mode when I asked it.

We've got GCDS setup and running on our Windows AD server now for several years. No big issues.

However, as we grow more into our Google Workspace I'm looking to make a change:

I've got an OU in AD that I don't want to Sync with GW - and vice-versa.

I'm looking to keep this "Service Accounts" OU separate between the two because each has accounts the other doesn't need.

I don't was GCDS to suspend users in GW if they don't exist in AD. I don't want wants GCDS to create users from this OU in GW if they don't exist. GCDS should just ignore the OU all together - leaving whatever is in there as-is.

I'm also not looking for a solution that involves individually making exemptions on a per-account basis - the idea is to that any account created in either location within that specific OU will just be left alone during the Sync.

Has someone successfully done this? It doesn't seem like it should be tricky but I'm having a hard time getting it to work right.

Re: GCDS Filter/Exception to OMIT a Single OU

dyresons — Tue, 05 May 2026 19:18:04 GMT

you can accomplish this a few ways.

You can set up to only search specific OU's for users.

This would add staff to a google ou called staff, if they have an email address and if they are a member of a specific group.

Another option would be to change the base dn for a search on the LDAP configuration tab. If your service accounts were in an OU outside of the search setting.

Re: GCDS Filter/Exception to OMIT a Single OU

Justin_W — Tue, 05 May 2026 19:25:36 GMT

>This would add staff to a google ou called staff, if they have an email address and if they are a member of a specific group.

This seems like it's suggesting a complete re-design of my OU structure (moving all staff to a specific OU). That's definitely not what I'm looking for.

>Another option would be to change the base dn for a search on the LDAP configuration tab. If your service accounts were in an OU outside of the search setting.

This may be the answer - but I'm not clear on how I actually do this properly for my case.

I'm not overly familiar with the syntax that AD is using here - How would I tell it to do everything it's currently doing, just omit a specific OU named "Service Accounts" (and any of its child OUs)?

Re: GCDS Filter/Exception to OMIT a Single OU

dyresons — Thu, 07 May 2026 12:50:59 GMT

can you share a sample structure of your AD structure and your current base dn seach we we know where you have started looking for accounts.

Re: GCDS Filter/Exception to OMIT a Single OU

Justin_W — Thu, 07 May 2026 14:47:08 GMT

Hope this helps. I'm stumped and surprised it seems like such a tricky task (I haven't gotten help elsewhere)

Re: GCDS Filter/Exception to OMIT a Single OU

alexgrutza — Thu, 07 May 2026 16:33:18 GMT

I believe you'd could add in the "Organizational Units" setting on the left in GCDS, an exclusion rule specifically identifying the Service Accounts OU. Another option would be to add multiple "Org Units" search locations (like all of the OUs) and manually leave the Service Accounts OU not listed in the search criteria.

Hope that helps

Re: GCDS Filter/Exception to OMIT a Single OU

Olger — Thu, 07 May 2026 22:31:14 GMT

I can confirm exclusion rules are for this purpose. We use GCDS to sync to GWS and we have some exclusion rules setup in Org Units (in GCDS) and also in Google Domain Conf (in GCDS) to exclude some OU's in GWS from being looked at by GCDS when syncing.

GCDS can get quite complex but it generally works well.

Re: GCDS Filter/Exception to OMIT a Single OU

Kim_Nilsson — Fri, 08 May 2026 14:19:15 GMT

GCDS is a fun little toy! 🙂

There are probably several ways to solve this.

One easy way would be to make sure all users within the AD OU Service Accounts to be member of an AD-group, and then !exclude those members from being synced.

Or, add the full OU path to the LDAP query in the Rule field. Perhaps as an OR to the negative rule of not syncing disabled users. or its own AND rule.

This should do it.

(& (objectCategory=person) (objectClass=user) (mail=*) (!(userAccountControl:1.2.840.113556.1.4.803:=2)) (!(distinguishedName=*,OU=Service Accounts,OU=ICS,DC=ics-milw,DC=org)) ) Actually I think a shorter version is enough. (& (objectCategory=person) (objectClass=user) (mail=*) (!(userAccountControl:1.2.840.113556.1.4.803:=2)) (!(OU=Service Accounts,OU=ICS,DC=ics-milw,DC=org)) )

Currently you have a veeeery simple rule to grab everything inside ICS.

The easiest way to accomplish what you want... is to add all users within ISC to a group, except for those in the Service Account OU, and add that as a requirement to your simple LDAP Rule. This logic can then be replicated however many excusion OUs you have in the AD.

Do note that, so far, all of this is done in the AD.

Next step, making sure GCDS doesn't touch manually created accounts.

In the Google rules at the top of GCDS, you should also exclude any and all OUs where you have manually created users, as GCDS should never touch them. And you should, of course, never put manual users inside OUs of synced users.

Re: GCDS Filter/Exception to OMIT a Single OU

Justin_W — Wed, 26 Aug 2026 15:19:32 GMT

Back to the past here...

We never did resolve this properly. We ended up just dealing with the "Service accounts" OU and users being put in our Google Workspace too.

Now, I've got the same issue again - but for our Students OU Since moving forward we'll no longer be creating student accounts in AD.

Google's support has been abysmal. I'm 60% they're just responding with AI answers since the last 5 emails have been them suggesting things that either don't work or don't even exist. All while claiming "24/7" support (It's been 6 days of back and forth via email with them)

Anyhow...

To your reply - we don't sync groups, so I imagine that's why we didn't just implement your suggestion.

Turning on groups at this point would probably create a whole new mess, I imagine.

It baffles me that there isn't a simply, quick solution to this. It *seems* like simply excluding the Student OU should suffice, but that's obviously not the case.

The issue as I see it is as follows:

The Students OU already exists in both locations (AD and GW). Student OU is populated with many sub-Ous (we make Grad Year OUs, so : 2027,2028,2029, etc). Each of those SubOus contains the students from that years. Then there are "Archive" folders for each year for students that have left.

I cannot find a way to get GCDS to stop either trying to create or remove the students/OUs in GW, despite all that Google Support has suggested.

If it helps, we do use a different subdomain for students - so maybe there's a way to do it via email and just exclude *.student.ics-edu.org?

Appreciate any help you any be able to provide since I'm having no luck anywhere else.

Re: GCDS Filter/Exception to OMIT a Single OU

Kim_Nilsson — Tue, 15 Sep 2026 08:25:32 GMT

Oh, there is a simple tick box to tell GCDS to never manage OUs, only users.

I always have that ticked. I never want GCDS to create or remove OUs.

Re: GCDS Filter/Exception to OMIT a Single OU

Kim_Nilsson — Tue, 15 Sep 2026 08:27:46 GMT

And, yes, in/excluding users in AD based on their value in the mail attribute is the easiest way to manage who should be created in GW. Or, even better, use a custom attribute, and populate that with the email address they should have in GW, and, of course, only populate it for those user who you really want to include in GW.

Re: GCDS Filter/Exception to OMIT a Single OU

Justin_W — Tue, 15 Sep 2026 19:50:10 GMT

I did end up getting this sorted out - but not quite how I had imagined it'd work.

I was luck to be able to just use the email filter since our students have a different email subdomain - and in this case my goal was to omit students from the sync moving forward. I had assumed I'd easily achieve that by just omitting the top level Student OU. But that lead to a host of different issues that had me going in circles.

Just as an aside - I'm convinced Google's "24/7 Support" for this is 100% AI agent based. Calling the phone number doesn't get help because that person isn't qualified to help with GCDS issues. There's a different "team" for that - and they aren't available by phone (despite me being asked if I preferred phone and being told they'd call me back instead of just using email).

My back and forth with that "support" via email/ticket went in circles as they gave me wrong directions, told me to change settings/options that don't even exist, and I ended up having to explain all of this to them. I then told them I was looking at using email instead and they said that would work too (and was the "recommended practice!" - despite them never recmonneding it. ). They they went on to tell me the best way was really to limit the scope of my primary sync - and just add the OUs I wanted to include (instead of the other way around - broad scope and omit). I once again asked for clarification that they were saying the only/best way to do it was to individually add each OU (let's say I have 300 of them...) one at a time to the search vs. just omitting the few (let's say 5) I don't want. They first said yes. Then said no, and went back to giving me the same instructions they gave at the beginning of the support ticket which we already agreed wasn't working...

VERY disappointing.