Oh, here's another way if you cannot config AD to allow search from root dn (dc=example,dc=com): Uses LDAP query files in Postfix instead of one, and use different base dn (ou=Employees, ou=Parttime) in them. For example:
Original one:
smtpd_sender_login_maps = proxy:ldap:/etc/postfix/ad_sender_login_maps.cf
We now use two query files instead:
smtpd_sender_login_maps =
proxy:ldap:/etc/postfix/ad_sender_login_maps_employees.cf,
proxy:ldap:/etc/postfix/ad_sender_login_maps_partime.cf
Update ad_sender_login_maps_employees.cf to use ou=Employees as search base dn:
search_base = ou=Employees,dc=example,dc=com
Update ad_sender_login_maps_partime.cf to use ou=Parttime as search base dn:
search_base = ou=Parttime,dc=example,dc=com
That's all. And replace other LDAP queries the same way.
Again, please try to configure AD to allow searching from root dn (dc=example,dc=com) first.