How to get SID of a group once i get groups of a user in Active Directory?

c# windows active-directory active-directory-group
phanish m picture phanish m · Jul 3, 2012 · Viewed 12.4k times · Source

I am using DirectorySearcher to get groups of a User in ActiveDirectory.

My Question is how to get SID associated with each group once i get user groups using "memberOf"?

I am working in .NETFramework 2.0 Environment.

DirectoryEntry entry = new DirectoryEntry(string.Format("LDAP://{0}", sUserDomain));
DirectorySearcher mySearcher = new DirectorySearcher(entry);
mySearcher.Filter = string.Format("(&(objectClass=user) (cn= {0}))", ui.DisplayName.ToString());
mySearcher.PropertiesToLoad.Add("memberOf");
SearchResult searchresult = mySearcher.FindOne();

Answer

Harvey Kwok picture Harvey Kwok · Jul 4, 2012

There is no way to do it in one single LDAP search because memberOf returns a distinguish name. You have to do another bind to get the objectSid attribute from the group object. Here is the code.

DirectoryEntry entry = new DirectoryEntry(string.Format("LDAP://{0}", sUserDomain));
DirectorySearcher mySearcher = new DirectorySearcher(entry);
mySearcher.Filter = string.Format("(&(objectClass=user) (cn= {0}))", ui.DisplayName.ToString());
mySearcher.PropertiesToLoad.Add("memberOf");
SearchResult searchresult = mySearcher.FindOne();

foreach (string dn in searchresult.Properties["memberOf"])
{
    DirectoryEntry group = new DirectoryEntry(string.Format("LDAP://{0}/{1}", sUserDomain, dn));
    SecurityIdentifier sid = new SecurityIdentifier(group.Properties["objectSid"][0] as byte[], 0);
    Console.Out.WriteLine(sid.Value);
}

Related questions

DirectoryEntry.Invoke("groups",null) not retrieving all groups?

I created a WCF web service to return user and group information from Active Directory. It works for most groups and users. I use directoryEntry.Invoke("groups",null) to return the groups a specified user is member of. This returns …

Read More
How do I get the current windows user's name in username@domain format?

I know that the following function returns the current Windows user's name in domain\username format. Convert.ToString( WindowsIdentity.GetCurrent().Name ); But how do I obtain the user's name in username@domain format? EDIT: I'm responding in this edit as …

Read More
How to delete a file after checking whether it exists

How can I delete a file in C# e.g. C:\test.txt, although apply the same kind of method like in batch files e.g. if exist "C:\test.txt" delete "C:\test.txt" else return nothing (ignore)

Read More