GetAuthorizationGroups returns more groups than my user in

Question

I found this post to get user security groups.

I had to change it a bit to make it look like this:

public List<GroupPrincipal> GetGroups(string userName, string userPassword, string userDomain) { List<GroupPrincipal> result = new List<GroupPrincipal>(); // establish domain context PrincipalContext yourDomain = new PrincipalContext(ContextType.Domain, userDomain, userName, userPassword); // find your user UserPrincipal user = UserPrincipal.FindByIdentity(yourDomain, IdentityType.SamAccountName, userName); // if found - grab its groups if (user != null) { PrincipalSearchResult<Principal> groups = user.GetAuthorizationGroups(); // iterate over all groups foreach (Principal p in groups) { // make sure to add only group principals if (p is GroupPrincipal) { result.Add((GroupPrincipal)p); } } } return result; } 

Unfortunately, now I get every security group in AD, not just the ones the user is in. My user is in 10 groups, but he returns 71. I had to provide a username and password, otherwise I would not be allowed to search for groups. This is an administrator account in a different domain, so I could not use the current credentials.

If you need more information, please let me know.

Greetings and thanks in advance IG

Answer 1

Is it likely that 10 groups are members of other groups? According to the documentation :

UserPrincipal.GetAuthorizationGroups Method

This method searches all groups recursively and returns the groups in which the user is a member. The returned set may also include additional groups that the system will consider the user a member for authorization.