up vote 2 down vote favorite
1
share [g+] share [fb]

I have a .net web application which needs to obtain the groups a user is a member of in Active Directory.

Todo this I am using the memberOf attribute on the users records.

I need to know the permissions required to read this attribute on all users records.

Currently I am getting inconsistent results when trying to read this attribute. For example I have a user group of 30 users in the same OU path. Using my own credentials to query AD - I can read the memberOf attribute for some users but not others. I know all the users have a memberOf attribute set as I have checked when logged on with a domain admin account.

link|improve this question
feedback

1 Answer

up vote 2 down vote accepted

On your domain object, you need to assign the querying user the "Read MemberOf" right to User objects.

  • Open AD U&C browse to your domain object
  • Right click and go to properties
    adu-n-c-domain
  • Security tab, click Advanced
  • Click Add
  • Enter the user name to add
  • Click the Properties tab
  • In 'Apply Onto' change the type to User
  • Click the "Read MemberOf" checkbox
    ldap-read-member-of
  • OK out of there

That should set it up so that the specified account can read the group memberships of all User accounts in the domain.

link|improve this answer
I cannot see these options. I am using ADUC on server 2003. which item do you mean by the domain object? I cannot see a security tab on any property dialogs. – Adam Jenkin Aug 5 '10 at 14:47
@Adam I added some explanatory screen-shots. – sysadmin1138♦ Aug 5 '10 at 15:28
Thanks sysadmin - I still cannot see a security tab when clicking properties on my test domain (its a server 2003 vm - set up by me.. a developer :P so could be wrong).. heres a picture of the properties screen I see. tinypic.com/r/10p7cdy/4 – Adam Jenkin Aug 5 '10 at 16:38
Ah, that's it. Go to View and select Advanced Features. It'll show up once that's turned on. I always have that on so I forget that it's there :} – sysadmin1138♦ Aug 5 '10 at 16:51
Many thanks SysAdmin - All solved now :) – Adam Jenkin Aug 6 '10 at 9:59
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.