We have to search users in AD in case users are distributed in several containers (OU) among AD tree.
But only users from base container are syncronized.
Is it possible to search users among all OU containers of AD treee?
Of course it is possible. As long as your search base is generic enough and your queries do not exclude specific groups/users based on their path, this should already work. Alternatively, you can always create multiple LDAP/AD configurations to synchronize different substructures into Alfresco - only in that case you can / should no longer use the alfresco-global.properties file, but instead do a proper Authentication subsystem configuration via alfresco/extension/subsystems/Authentication/ldap-ad/... path.
Please note that your groupQuery and groupDifferentialQuery differ in that the differential query does not include the CN=webadmin condition.
Thank you, I have managed to make AD synchronization working by changing queries.
Additional thank for CN=webadmin condition.