LDAP Filter Question

This is开发者_开发问答 the filter I am using:

(&(ObjectClass=user)(employeeID=*)(mail=*))

And I get back what I need. However, there are way too many results return and so I want to only get those users whose sn starts with an 'a'.

So, I changed my filter to:

(&(ObjectClass=user)(employeeID=*)(mail=*)(sn=a*))

But there is no change in the results from the orignal filter.

What am I doing wrong here?

The implication of that is that the filter (sn=a*) doesn't actually work, which is hard to believe. You could try putting it first in the filter string, but I think it's much more likely that you aren't executing the code you think you're executing.