I have a .net web application which needs to obtain the groups a user is a member of in Active Directory.

Todo this I am using the memberOf attribute on the users records.

I need to know the permissions required to read this attribute on all users records.

Currently I am getting inconsistent results when trying to read this attribute. For example I have a user group of 30 users in the same OU path. Using my own credentials to query AD - I can read the memberOf attribute for some users but not others. I know all the users have a memberOf attribute set as I have checked when logged on with a domain admin account.

2 Answers 2


On your domain object, you need to assign the querying user the "Read MemberOf" right to User objects.

  • Open AD U&C browse to your domain object
  • Right click and go to properties:


  • Security tab, click Advanced
  • Click Add
  • Enter the user name to add
  • Click the Properties tab
  • In 'Apply Onto' change the type to User
  • Click the "Read MemberOf" checkbox:


  • OK out of there

That should set it up so that the specified account can read the group memberships of all User accounts in the domain.

  • 2
    Thanks sysadmin - I still cannot see a security tab when clicking properties on my test domain (its a server 2003 vm - set up by me.. a developer :P so could be wrong).. heres a picture of the properties screen I see. tinypic.com/r/10p7cdy/4 Aug 5, 2010 at 16:38
  • 10
    Ah, that's it. Go to View and select Advanced Features. It'll show up once that's turned on. I always have that on so I forget that it's there :}
    – sysadmin1138
    Aug 5, 2010 at 16:51
  • FWIW, this does not seem to apply to Windows Server 2012 where the Add dialog is quite different. May 19, 2016 at 17:47
  • For the benefit of any users on Server 2008R2, these instructions are equally applicable, but the property tab is slightly different than what is described/pictured. The setting is labeled "Apply to:" and the correct value is "Descendant User Objects". All other instructions remain the same.
    – jmbpiano
    Mar 5, 2018 at 18:13
  • Many, many permissions... sysadmin1138.net/images/ldap-read-member-of.png
    – Kiquenet
    Jul 14, 2018 at 9:34

I had a similar issue and solved it on another level with a request to the AD:


for the "dn" attribute.

As groups are readable by default, this will return an equal result to the "membersOf" property.

I know this is not really an answer to the permission question, but i landed here searching for a way to get the memberOf property without a permission-change in AD.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.