I have two domains A and B

Domain A contains a security-group SEC. This group is used to access a web application. The group is a security group, and the type of the group is domain local. This domain also contains most of the users.

Domain B contains a few users, and these users are direct members of the security group located in domain A

In my web application (ASP.NET MVC) i use the integrated windows auth provider, which checks if a user is a member of the security group. Afterwards i locate the user in active directory, and assigns the user a bunch of roles based on what active directory groups they are a member of.

When querying the tokengroups property on the users from domain A i can see they are member of the SEC group.

But when querying the members of domain B, also by using the tokengroups property, I do not see the SEC group in the tokengroups property.

My questions

  • Why do the members in domain B seems to not be a member of the group, when they really are? I use the tokengroups property when looking up groups on a user.

    The reason i belive they are is because i can see the users in the list of members when looking at the properties of the group. Furthermore, they are authenticated in the web application, but when my module tries to find the groups of the members from domain B, the SEC group is just not there.

  • Is the current setup with all the groups being security groups, and domain local, really the best way? What I need is a bunch of "marker" groups that i can add groups and users to, from multiple domains.

To get the security groups of a user, i use the tokengroups property. Like this http://tutorials.csharp-online.net/User_Management_with_Active_Directory%E2%80%94Retrieving_the_Users_Token_Groups

  • Your query is LDAP, not the GC?
    – Greg Askew
    Commented Sep 12, 2013 at 11:28
  • I'm not sure what you mean? The way i (try to) find the groups on a user, is by refreshing the DirectoryEntry after finding the user by his or her username. And then looking in the TokenGroups property on the user. This works, but the result is missing the SEC group when doing this on the user from domain B.
    – Moulde
    Commented Sep 12, 2013 at 12:52
  • DirectoryEntry.Path - does it start with LDAP:// or GC:// ?
    – Greg Askew
    Commented Sep 12, 2013 at 13:40
  • Yes, it starts with LDAP://
    – Moulde
    Commented Sep 12, 2013 at 19:39

1 Answer 1


I think you need to bind to a GC to correctly retrieve tokenGroups from Active Directory. i.e. in your bindstring, you should replace LDAP:// with GC:// and hopefully this should then work.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .