I have a .net web application which needs to obtain the groups a user is a member of in Active Directory.

Todo this I am using the memberOf attribute on the users records.

I need to know the permissions required to read this attribute on all users records.

Currently I am getting inconsistent results when trying to read this attribute. For example I have a user group of 30 users in the same OU path. Using my own credentials to query AD - I can read the memberOf attribute for some users but not others. I know all the users have a memberOf attribute set as I have checked when logged on with a domain admin account.

up vote 25 down vote accepted

On your domain object, you need to assign the querying user the "Read MemberOf" right to User objects.

  • Open AD U&C browse to your domain object
  • Right click and go to properties:

    adu-n-c-domain

  • Security tab, click Advanced
  • Click Add
  • Enter the user name to add
  • Click the Properties tab
  • In 'Apply Onto' change the type to User
  • Click the "Read MemberOf" checkbox:

    ldap-read-member-of

  • OK out of there

That should set it up so that the specified account can read the group memberships of all User accounts in the domain.

  • 2
    Thanks sysadmin - I still cannot see a security tab when clicking properties on my test domain (its a server 2003 vm - set up by me.. a developer :P so could be wrong).. heres a picture of the properties screen I see. tinypic.com/r/10p7cdy/4 – Adam Jenkin Aug 5 '10 at 16:38
  • 8
    Ah, that's it. Go to View and select Advanced Features. It'll show up once that's turned on. I always have that on so I forget that it's there :} – sysadmin1138 Aug 5 '10 at 16:51
  • FWIW, this does not seem to apply to Windows Server 2012 where the Add dialog is quite different. – Chris Nelson May 19 '16 at 17:47
  • For the benefit of any users on Server 2008R2, these instructions are equally applicable, but the property tab is slightly different than what is described/pictured. The setting is labeled "Apply to:" and the correct value is "Descendant User Objects". All other instructions remain the same. – jmbpiano Mar 5 at 18:13
  • Many, many permissions... sysadmin1138.net/images/ldap-read-member-of.png – Kiquenet Jul 14 at 9:34

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.