How to get indirect AD user groups? - WITH#

Question

I use DirectorySearcher to get the AD user groups in which it is a member of the 'memberof' property. But according to this msdn page, the 'memberof' property returns only direct groups in which the user is a member. How can I get indirect user groups.

For instance,

 Group A -> User X, User Y, Group B Group B -> User Z Group C -> User Z 

I want to get the result as group A, group B, group C for user Z, since he is an indirect user of group A.

Update

Okie. I followed this code article to get recursive groups. But still, the built-in group "Domain Users" is not in the list. Does this mean that inline groups do not appear in the search directory?

Answer 1

You must define your own iteration method through direct groups until you reach a common root for everyone. You will need to perform an LDAP query for each group and use the same memberOf attribute to determine which groups the group belongs to. This can be intense over time, especially if the groups are large and laid out as web pages.

Answer 2

My answer follows the same lines as Joel Etherton, but with code. I implemented this some time ago in one of my applications. All you have to do is interpret VB.Net in C # :). The code below will take the group and return all child groups. So you just need to loop through each group and put them in a list. I refer to several methods that I did not include, but should be self explanatory. I have included PrincipalGenericCollection, as it may be convenient.

 Public Function GetSubGroups(ByVal groupname As String) As List(Of String) Dim result As New List(Of String)() GetSubGroups(groupname, result) Return result End Function Public Sub GetSubGroups(ByVal Group As String, ByRef l As List(Of String)) Dim grp = GetGroup(Group) 'sometimes group will be null if its a system built in group like "authenticated users"' If grp Is Nothing Then Exit Sub End If Dim sGroups = GetGroupMembership(Group, False).Where(Function(c) TypeOf c Is GroupPrincipal) For Each g In sGroups Dim n As String = FormatPrincipalName(g.Name) If Not l.Contains(n) Then l.Add(n) GetSubGroups(g.Name, l) End If Next End Sub Public Function GetGroupMembership(ByVal GroupName As String, Optional ByVal Recursive As Boolean = True) As PrincipalGenericCollection(Of Principal) Dim group As GroupPrincipal = GetGroup(GroupName) If group Is Nothing Then Return Nothing End If Dim prinCol As New PrincipalGenericCollection(Of Principal)(group.GetMembers(Recursive)) prinCol.SortByName() Return prinCol End Function Public Class PrincipalGenericCollection(Of T As Principal) Inherits List(Of T) Public Sub New() MyBase.New() End Sub Public Sub New(ByVal collection As PrincipalCollection) For Each p As Principal In collection Me.Add(p) Next End Sub Public Sub New(ByVal collection As IEnumerable(Of T)) MyBase.New(collection) End Sub Public Sub SortByName() Sort(New PrincipalSorter(Of T)) End Sub End Class 

Answer 3

The primary user group will not be displayed in the "memberOf" property. Instead, its RID is stored in the "primaryGroupID" property, and you need to calculate the SID of the group from this RID (which is the RID of the SID + domain).

This is why you could not find the domain user group (which is the main user group)

Answer 4

Sounds to me like a simple recursive approach. Find the groups, the user is a member, and for each group, find the groups to which the group belongs. Repeat until more membership is found.