CODEWITHSUNDEEP
c#asp.netactive-directorydirectoryservices
Logan Garland
Logan Garland

Reputation: 242

Find local groups that a domain user belongs to?

I'm using the System.DirectoryServices.AccountManagement namespace to find domain users and their corresponding AD security groups. This works well.

I'm also using that namespace to query the local security groups on a remote server. I am able to find a security group and then list the users of that group no problem.

What I'm having issues with is displaying which LOCAL groups a DOMAIN user belongs to:

PrincipalContext localmachine = new PrincipalContext(ContextType.Machine, "ServerName");
PrincipalContext domain = new PrincipalContext(ContextType.Domain);

// find the user using the domain context (Works fine)
UserPrincipal user = UserPrincipal.FindByIdentity(domain, userName);

// if found - grab its groups
if (user != null)
{
    // The get groups method is the only method that would accept a new context
    PrincipalSearchResult<Principal> groups = user.GetGroups(localMachine);

    // no groups are returned .... removed rest of code
}

I'm attempting to use the GetGroups method passing in the localMachine PrincipalContext but no groups are returned.

The users exists only in the Domain AD. There is not an entry for this user in the local users on the localMachine. The domain users are added to local security groups.

Any ideas? I'd like to be able to pull a list of all local groups this domain user belongs to and then see if a certain groups exists in that list. The only option that is working now is for me to search certain groups on the system and see if the domain user belongs to that group.

Upvotes: 5

Views: 6274

Answers (2)

boggy
boggy

Reputation: 4027

I know my answer is late, but this worked for me (after I tried all sorts of permutations):

private static IList<string> GetUserLocalGroups(string userAccountName, string computerName, string domainName)
{
  List<string> groups = new List<string>();

  // We have to deal with a local computer
  DirectoryEntry root = new DirectoryEntry(String.Format("WinNT://{0},Computer", computerName), null, null, AuthenticationTypes.Secure);


  foreach (DirectoryEntry groupDirectoryEntry in root.Children)
  {
    if (groupDirectoryEntry.SchemaClassName != "Group")
      continue;

    string groupName = groupDirectoryEntry.Name;
    Console.WriteLine("Checking: {0}", groupName);
    if (IsUserMemberOfGroup(groupDirectoryEntry, String.Format("WinNT://{0}/{1}", domainName, userAccountName)))
    {
      groups.Add(groupName);
    }
  }

  return groups;
}

private static bool IsUserMemberOfGroup(DirectoryEntry group, string userPath)
{
  return (bool)group.Invoke(
      "IsMember",
      new object[] { userPath }
      );
}

The call is something like this:

GetUserLocalGroups("samaccountname", "computerName.yourdomain", "yourdomain");

Upvotes: 3

Michael
Michael

Reputation: 9044

The following code will return the local groups that a domain user is member of:

        PrincipalContext domain = new PrincipalContext(ContextType.Domain);
        UserPrincipal user = UserPrincipal.FindByIdentity(domain, userName);
        foreach (GroupPrincipal group in user.GetAuthorizationGroups())
        {
            if (group.Context.ConnectedServer == serverName)
                Console.Out.WriteLine("{0}\\{1}", group.Context.Name, group.SamAccountName);
        }

Upvotes: 3

Related Questions