Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am writing some code to look up the members of particular domain groups. Does the user that this application runs as need any particular permissions on the domain to get this information?

Background: I have already determined that the application needs to be run as a domain user to be able to query information from the domain. I have a list of group names and for each group, I need to look up the members of that group on the domain and get their names/usernames.

share|improve this question
up vote 3 down vote accepted

No. Even as a domain user, no extra permissions, you can still run AD Users and Computers resource... shouldn't be a problem to add this functionality to a script.

Are you using showmbrs to do this? I.e.: #showmbrs domain\group name >returns members. If all you are trying to get is user names in the CLI this will do it for you.

I should have said that showmbrs is part of the resource kit and is available to download.

share|improve this answer
No, this has to be part of a larger application so it is pure C# code. I'm just concerned that certain domain users may not have permissions to get this information. – adrianbanks Jun 18 '10 at 15:03
+1 - "Normal" unprivileged users will be able to query group membership in any group in a stock Active Directory domain. If you've played with the ACLs, though, all bets are off. – Evan Anderson Jun 18 '10 at 17:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.