All objects carry with them a complete hierarchy of objects classes, but
when we talk about the class of an object in IDM we are talking about
the "base class" ("structural class" in LDAP terminology), and each
object has only one of those (the leafmost of the hierarchy).
Unfortunately, many tools will not actually show you what the base class
of the object is, though I believe that both iMonitor and DSBrowse will.

-Father Ramon

Will Schneider wrote:
> It isn't an object class condition that is missing it, the filter is ignoring it
>
> When I add dynamic group to the filter, it picks these groups up. So something in IDM is reading a specific object class value. Just trying to figure out how to work around this. At first glance it would appear this would make group sync much more complicated.