Best Practices

The idea behind using the KBOX_COMPUTER_NAME variable is that it will be replaced when the computer is checking in with the KBOX. So, to a certain extent, you are correct that this variable represents all PCs in KBOX inventory, but it does it one at a time, during check in, to decide if that PC should be added to the label. It's essentially the same as a Smart Label, but using an LDAP query instead of a SQL query.

That being said, you won't see any results in the label test if you put in the KBOX_COMPUTER_NAME variable (since that variable is only replaced at run-time). What you need to do when testing is manually replace it with a PC name you want to test the filter against. If it works, then plug in the variable and save the LDAP label.

We've had some success with LDAP labels using CN= instead of NAME=. Also the objectcategory field has quite a bit more information in it than just "computer", so you may want to use objectClass there. Finally, I believe the & function only supports 2 parts, so you may have to nest a few &'s together. Here's what I would suggest trying:

(&(objectClass=computer)(&(CN=KBOX_COMPUTER_NAME)(memberOf=CN=Label-Test,OU=SOE_Standard,OU=Desktops,DC=testdomain,DC=local)))

We've also used the distinguishedName field (but we don't have our computers in any Groups beyond the default "Domain Computers"):

(distinguishedName=CN=KBOX_COMPUTER_NAME,OU=SOE_Standard,OU=Desktops,DC=testdomain,DC=local)

Hope this helps.

Thank you for your response, but unfortunately it has taken me a while to get back to this problem. 

What I discovered when I accident pasted your solution directly into Search Filder, without change the Domain name, was that I got a postive "LDAP Search successful", the filter was shown as being Successful.

How is this result possible when the "BASE DN:" does not match the Filter? It appears I can write anything in the filter and the Test will come back as successful.

Testing LDAP Label Settings...
Testing "LDAP_Test_Label-CjD" connection to: ldaps://dc-prd on Port: 389
OK: Connection Successful.
OK: Setting Protocol Version 3 Successful.
OK: Setting LDAP REFERRALS Option 0 Successful.
OK: Search Bind using LDAP supplied credentials Successful.
Applying search filter [(&(objectClass=computer)(&(CN=KBOX_COMPUTER_NAME)(memberOf=CN=Label-Test,OU=SOE_Standard,OU=Desktops,DC=testdomain,DC=local)))]
OK: LDAP search (with filter [(&(objectClass=computer)(&(CN=KBOX_COMPUTER_NAME)(memberOf=CN=Label-Test,OU=SOE_Standard,OU=Desktops,DC=testdomain,DC=local)))]) Successful.
OK: LDAP Search successful with 0 entries found.
OK: LDAP Test Successful. Closing connection.

Interestingly, if one does use a single computer to search for, one see that the results are it has found one machine

OK: LDAP Search successful with 1 entries found

But when I check the results in Label Detail, I find this +Computers (1057) 

How is it doing this?