Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a .net web application which needs to obtain the groups a user is a member of in Active Directory.

Todo this I am using the memberOf attribute on the users records.

I need to know the permissions required to read this attribute on all users records.

Currently I am getting inconsistent results when trying to read this attribute. For example I have a user group of 30 users in the same OU path. Using my own credentials to query AD - I can read the memberOf attribute for some users but not others. I know all the users have a memberOf attribute set as I have checked when logged on with a domain admin account.

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

On your domain object, you need to assign the querying user the "Read MemberOf" right to User objects.

  • Open AD U&C browse to your domain object
  • Right click and go to properties
    adu-n-c-domain
  • Security tab, click Advanced
  • Click Add
  • Enter the user name to add
  • Click the Properties tab
  • In 'Apply Onto' change the type to User
  • Click the "Read MemberOf" checkbox
    ldap-read-member-of
  • OK out of there

That should set it up so that the specified account can read the group memberships of all User accounts in the domain.

share|improve this answer
    
I cannot see these options. I am using ADUC on server 2003. which item do you mean by the domain object? I cannot see a security tab on any property dialogs. –  Adam Jenkin Aug 5 '10 at 14:47
    
@Adam I added some explanatory screen-shots. –  sysadmin1138 Aug 5 '10 at 15:28
2  
Thanks sysadmin - I still cannot see a security tab when clicking properties on my test domain (its a server 2003 vm - set up by me.. a developer :P so could be wrong).. heres a picture of the properties screen I see. tinypic.com/r/10p7cdy/4 –  Adam Jenkin Aug 5 '10 at 16:38
2  
Ah, that's it. Go to View and select Advanced Features. It'll show up once that's turned on. I always have that on so I forget that it's there :} –  sysadmin1138 Aug 5 '10 at 16:51
    
Many thanks SysAdmin - All solved now :) –  Adam Jenkin Aug 6 '10 at 9:59
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.