KACE Product Support

Has anyone ever created an LDAP label that includes a wildcard? I would like a label that will apply to all machines in OUs beneath a certain level, but the LDAP labels only seem to apply to a specific terminal OU (one without children).

Our AD structure includes separate OUs for each lab:
Lab Systems
->Building 1
---->Lab 1
---->Lab 2
->Building 2
---->Lab 1

etc.

I tried making an LDAP label that looks for:
distinguishedName=CN=KBOX_COMPUTER_NAME,*,OU=Lab Systems,OU=GPO Exceptions,DC=FAS,DC=LCL)

but it doesn't apply to any systems. If I include the entire OU tree then the label applies, but I don't want a label for each lab, I'd like a label that would apply to all systems beneath the Lab Systems OU.

Thanks in advance.