diff --git a/debug_ad_filter.py b/debug_ad_filter.py
new file mode 100644
index 0000000..d24b411
--- /dev/null
+++ b/debug_ad_filter.py
@@ -0,0 +1,55 @@
+#!/usr/bin/env python3
+"""Debug: print the exact LDAP filter that works in lk/handlers.py"""
+
+import sys
+sys.path.insert(0, "/opt/trueconf_bot")
+from config.config import AD_USER, AD_PASSWORD, AD_SERVER, AD_BASE
+
+from ldap3.utils.conv import escape_filter_chars
+
+# Simulate lk/handlers.py filter
+user_id = "ds.krivochenko@tcs.sibcem.ru"
+search_id = user_id.replace("@tcs.sibcem.ru", "@sibcem.ru")
+short_username = search_id.split("@")[0]
+safe_user_id = escape_filter_chars(search_id)
+
+print(f"user_id: {user_id}")
+print(f"search_id: {search_id}")
+print(f"short_username: {short_username}")
+print(f"safe_user_id: {safe_user_id}")
+
+# lk/handlers.py filter
+filter_lk = f"(&(objectClass=user)(|(mail={safe_user_id})(userPrincipalName={safe_user_id})(userPrincipalName={escape_filter_chars(f'{short_username}@sibcem.ru')}))(sAMAccountName={escape_filter_chars(short_username)})))"
+print(f"\nFilter (lk format):")
+print(filter_lk)
+
+# Count parens
+opens = filter_lk.count('(')
+closes = filter_lk.count(')')
+print(f"\nOpen parens: {opens}, Close parens: {closes}")
+
+# Now test with the connection
+from ldap3 import Server, Connection, ALL
+server = Server(AD_SERVER, get_info=ALL)
+conn = Connection(server, user=AD_USER, password=AD_PASSWORD, auto_bind=True)
+
+print(f"\nSearching with filter...")
+conn.search(AD_BASE, filter_lk, attributes=["cn", "sAMAccountName", "mail", "userPrincipalName"])
+
+if conn.entries:
+    entry = conn.entries[0]
+    print(f"FOUND: cn={entry.cn}, mail={entry.mail if 'mail' in entry else 'N/A'}, sam={entry.sAMAccountName if 'sAMAccountName' in entry else 'N/A'}")
+else:
+    print("NOT FOUND in AD_BASE")
+
+# Try root
+conn2 = Connection(server, user=AD_USER, password=AD_PASSWORD, auto_bind=True)
+root_base = "DC=sibcem,DC=ru"
+print(f"\nSearching in {root_base}...")
+conn2.search(root_base, filter_lk, attributes=["cn", "sAMAccountName", "mail", "userPrincipalName"])
+
+if conn2.entries:
+    entry = conn2.entries[0]
+    print(f"FOUND: cn={entry.cn}, mail={entry.mail if 'mail' in entry else 'N/A'}, sam={entry.sAMAccountName if 'sAMAccountName' in entry else 'N/A'}")
+else:
+    print("NOT FOUND in root")
diff --git a/instruct/handlers.py b/instruct/handlers.py
index ad091da..78a9cd3 100644
--- a/instruct/handlers.py
+++ b/instruct/handlers.py
@@ -27,7 +27,7 @@ def _get_user_cn(user_id: str) -> str:
     user_id из TrueConf — это обычно email, например 'ds.krivochenko@tcs.sibcem.ru'
     Заменяет tcs.sibcem.ru на sibcem.ru для поиска в AD.
     """
-    from ldap3 import Server, Connection, ALL, SUBTREE
+    from ldap3 import Server, Connection, ALL
     from config.config import AD_SERVER, AD_USER, AD_PASSWORD, AD_BASE
     from ldap3.utils.conv import escape_filter_chars
 
@@ -35,40 +35,33 @@ def _get_user_cn(user_id: str) -> str:
         # Заменяем tcs.sibcem.ru на sibcem.ru
         search_id = user_id.replace("@tcs.sibcem.ru", "@sibcem.ru")
         short_username = search_id.split("@")[0] if "@" in search_id else user_id
-        safe_id = escape_filter_chars(search_id)
-        safe_short = escape_filter_chars(short_username)
 
         logger.info(f"AD lookup: user_id={user_id}, search_id={search_id}, short={short_username}")
 
         server = Server(AD_SERVER, get_info=ALL)
         conn = Connection(server, user=AD_USER, password=AD_PASSWORD, auto_bind=True)
 
-        # Пробуем несколько фильтров + разные базы поиска
-        filters = [
-            f"(mail={safe_id})",
-            f"(userPrincipalName={safe_id})",
-            f"(sAMAccountName={safe_short})",
-        ]
+        # Фильтр как в lk/handlers.py — работает
+        safe_user_id = escape_filter_chars(search_id)
+        search_filter = (
+            f"(&(objectClass=user)(|"
+            f"(mail={safe_user_id})"
+            f"(userPrincipalName={safe_user_id})"
+            f"(userPrincipalName={escape_filter_chars(f'{short_username}@sibcem.ru')}))"
+            f"(sAMAccountName={escape_filter_chars(short_username)})))"
+        )
+        logger.info(f"AD filter: {search_filter}")
 
-        # AD_BASE + корень домена для поиска во всём дереве
-        search_bases = [AD_BASE, "DC=sibcem,DC=ru"]
+        conn.search(AD_BASE, search_filter, attributes=["cn", "sAMAccountName", "mail", "userPrincipalName"])
 
-        for base in search_bases:
-            for filt in filters:
-                conn.search(
-                    search_base=base,
-                    search_filter=f"(&(objectClass=user)({filt}))",
-                    attributes=["cn", "sAMAccountName", "mail", "userPrincipalName"],
-                    search_scope=SUBTREE
-                )
-                if conn.entries:
-                    entry = conn.entries[0]
-                    cn = str(entry.cn)
-                    mail = str(entry.mail) if 'mail' in entry else "N/A"
-                    sam = str(entry.sAMAccountName) if 'sAMAccountName' in entry else "N/A"
-                    upn = str(entry.userPrincipalName) if 'userPrincipalName' in entry else "N/A"
-                    logger.info(f"AD found: cn={cn}, mail={mail}, sam={sam}, upn={upn}, base={base}")
-                    return cn
+        if conn.entries:
+            entry = conn.entries[0]
+            cn = str(entry.cn)
+            mail = str(entry.mail) if 'mail' in entry else "N/A"
+            sam = str(entry.sAMAccountName) if 'sAMAccountName' in entry else "N/A"
+            upn = str(entry.userPrincipalName) if 'userPrincipalName' in entry else "N/A"
+            logger.info(f"AD found: cn={cn}, mail={mail}, sam={sam}, upn={upn}")
+            return cn
 
         logger.warning(f"AD not found for user_id={user_id}, search_id={search_id}, short={short_username}")
     except Exception as e: