Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a .net web application which needs to obtain the groups a user is a member of in Active Directory.

Todo this I am using the memberOf attribute on the users records.

I need to know the permissions required to read this attribute on all users records.

Currently I am getting inconsistent results when trying to read this attribute. For example I have a user group of 30 users in the same OU path. Using my own credentials to query AD - I can read the memberOf attribute for some users but not others. I know all the users have a memberOf attribute set as I have checked when logged on with a domain admin account.

share|improve this question
up vote 19 down vote accepted

On your domain object, you need to assign the querying user the "Read MemberOf" right to User objects.

  • Open AD U&C browse to your domain object
  • Right click and go to properties
  • Security tab, click Advanced
  • Click Add
  • Enter the user name to add
  • Click the Properties tab
  • In 'Apply Onto' change the type to User
  • Click the "Read MemberOf" checkbox
  • OK out of there

That should set it up so that the specified account can read the group memberships of all User accounts in the domain.

share|improve this answer
I cannot see these options. I am using ADUC on server 2003. which item do you mean by the domain object? I cannot see a security tab on any property dialogs. – Adam Jenkin Aug 5 '10 at 14:47
@Adam I added some explanatory screen-shots. – sysadmin1138 Aug 5 '10 at 15:28
Thanks sysadmin - I still cannot see a security tab when clicking properties on my test domain (its a server 2003 vm - set up by me.. a developer :P so could be wrong).. heres a picture of the properties screen I see. – Adam Jenkin Aug 5 '10 at 16:38
Ah, that's it. Go to View and select Advanced Features. It'll show up once that's turned on. I always have that on so I forget that it's there :} – sysadmin1138 Aug 5 '10 at 16:51
Many thanks SysAdmin - All solved now :) – Adam Jenkin Aug 6 '10 at 9:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.