by Emma Richardson.
Distinguished name needs to reference a user that has read (and write if you want to update from moodle) permissions on the ou in question.
The following references are from the understanding that IT ou is inside the production ou. Replace yourdomain etc with your info.
Context should be: ou=IT,ou=production,dc=yourdomain,dc=com
If you want to further limit to only the LMSUsers groups - you need to add the following to Object Class:
(|(&(objectClass=user)(!(objectClass=computer))(memberOf=cn=LMSUsers,ou=IT,ou=production ,dc=yourdomain,dc=com)))