Microsoft AD – Creating a Negative OU= LDAP Filter

I am trying to produce a LDAP Filter for MS AD which filters users based on some OUs (in my case excluding a specific OU but also including does not work):

(&(cn=Testuser1)(|(ou:dn:=Included1)(ou:dn:=Included2)))
(&(cn=Testuser1)(!(ou:dn:=Excluded)))

does not work. I tested (ou:dn:=Included1) which lists the actual "folder" objects (marked with * below) but not the users below that (with the DN containing the ou). I cannot use the search base because it should find multiple:

ou=Included1,dc=example,dc=com *
  cn=Testuser1,ou=Included1,dc=example,dc=com +
ou=Included2,dc=example,dc=com
  cn=Testuser1,ou=Included2,dc=example,dc=com +
ou=Excluded,dc=example,dc=com
  cn=Testuser1,ou=Excluded,dc=example,dc=com - 

In my two example filters above I want to find two Testuser1 entries (marked with +), not three (marked with -).

But it actually matches none. The actual user entries have no other differences in the attributes I can filter on.

What it feels like is that the "ou:dn:=" syntax only finds object where the first name component it the desired one, not any…?