0

I am writing some code to look up the members of particular domain groups. Does the user that this application runs as need any particular permissions on the domain to get this information?

Background: I have already determined that the application needs to be run as a domain user to be able to query information from the domain. I have a list of group names and for each group, I need to look up the members of that group on the domain and get their names/usernames.

1 Answer 1

3

No. Even as a domain user, no extra permissions, you can still run AD Users and Computers resource... shouldn't be a problem to add this functionality to a script.

Are you using showmbrs to do this? I.e.: #showmbrs domain\group name >returns members. If all you are trying to get is user names in the CLI this will do it for you.

I should have said that showmbrs is part of the resource kit and is available to download.

2
  • No, this has to be part of a larger application so it is pure C# code. I'm just concerned that certain domain users may not have permissions to get this information. Jun 18, 2010 at 15:03
  • 1
    +1 - "Normal" unprivileged users will be able to query group membership in any group in a stock Active Directory domain. If you've played with the ACLs, though, all bets are off. Jun 18, 2010 at 17:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .