How to get Active Directory Users not in a group.: VB.NET, Active Directory, Directory Searcher, Directory Entry

How to get Active Directory Users not in a group.

I'm using a directory entry and directory search combination to retrieve all the groups/users from an AD domain.

Right now I'm able to get all the groups then use those group CN's to get all the users within. However, I can't manage to retrieve the users not currently assigned into an active directory group!

By what means would I go about fetching these users?

Here's what I'm doing right now to get the users contained within the groups.

Public Function GetGroupUsers(ByVal pGroupCN As String) As ArrayList
        Try
            ' In our entry path we specify we want a group that has Users and is named as the parameter 'pGroupCN'
            Dim entry As New DirectoryEntry("LDAP://" & _server & "/CN=" & pGroupCN & "," & _domainPath, _username, _password)
            Dim search As New DirectorySearcher(entry)
            ' For each user in that group, get the 'cn' or common name property of that user and add it to our ArrayList
            Dim users As New ArrayList
            Dim userEntry As DirectoryEntry
            For Each member As Object In entry.Properties("person")
                userEntry = New DirectoryEntry("LDAP://" & _server & "/" & member.ToString(), _username, _password)
                users.Add(userEntry.Properties("cn")(0).ToString())
            Next
            Return users
        Catch ex As Exception
            Return Nothing
        End Try
    End Function

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:

Select all Open in new window

Instant Access to this Solution

Plus...

30 Day FREE access, no risk, no obligation

Collaborate with the world's top tech experts

Unlimited access to our exclusive solution database

Never be left without tech help again

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

"The time we save is the biggest benefit of Experts Exchange to Warner Bros. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange." Mike Kapnisakis, Warner Bros.

"Our team likes having a resource that is more secure than just using Google and most experts using this service really know their stuff. It's nice to look here first versus using Google." Dayna Sellner, Lockheed Martin

"Anytime that I've been stumped with a problem, 9 out of 10 times Experts Exchange has either the accepted solution or an open discussion of the potential solution to the problem." Kenny Red, eBay Inc.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.

Screenshot of Experts Exchange Knowledgebase

Need individual assistance?

Our experts are ready to help.

If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.

Want to learn from the best?

Read articles from industry experts.

Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.

Working on a long term project?

Store your work and research.

Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.

Join the Community

Give a Little. Get a Lot.

Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.

HI there,

This is a feature of ADSI. If you enumerate a user's group memberships, you will notice that it doesn't return Domain Users as a group, even though the user is a member. Similarly, if you enumerate members of Domain Users, it will not return every user.

memberof on a user, and member on a group are linked attributes. The primary attribute is member on the group, meaning that you can only edit this, and then the system updates the relevant user objects accordingly.

The reason for this is that Domain Users is the primary group by default. A user's primary group is not included in the 'memberof' attribute, meaning that it cannot be in 'member' in the corresponding group. This group is stored in the primary group ID attribute on the user object (primaryGroupID).

So that's why the search on Domain Users is coming back blank! This is by design.

So.... all users will be in at least one group, but if they are just in one group, then querying member or memberof will not yield what you want. I think it best to just exclude Domain Users from your report (as everyone is a member anyway) and you can use the following LDAP filter to get any user in NO OTHER groups:

(&(objectClass=user)(objectCategory=person)(!memberof=*))

I'm not a .NET expert, but I think the below should get you half way there. It's just an example of using the DirectorySearcher with an LDAP filter, outputting the users to the console.

Tony

Sub Main()
        Dim strOutPut As String
        Dim objRoot As DirectoryEntry = New DirectoryEntry("LDAP://DC=domain,DC=local")
        Dim oSearcher As DirectorySearcher = New DirectorySearcher(objRoot)
        oSearcher.SearchScope = SearchScope.Subtree
        oSearcher.Filter = "(&(objectClass=user)(objectCategory=person)(!memberof=*))"
        Dim colResults As SearchResultCollection
        Dim objResult As SearchResult)
        oSearcher.PropertiesToLoad.Add("distinguishedName")
        colResults = oSearcher.FindAll
  
        For Each objResult In colResults
            If Not objResult.GetDirectoryEntry().Properties("distinguishedName").Value = "" Then
                strOutPut += objResult.GetDirectoryEntry().Properties("distinguishedName").Value & vbCrLf
            End If
        Next
        Console.Write(strOutPut)
    End Sub

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:

Select all Open in new window

Question

How to get Active Directory Users not in a group.

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

VB.NET

Active Directory

Directory Searcher

Directory Entry

.NET

Microsoft Visual Basic.Net

Lightweight Directory Access Protocol (LDAP)

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Need individual assistance?

Our experts are ready to help.

Want to learn from the best?

Read articles from industry experts.

Working on a long term project?

Store your work and research.

What Makes Experts Exchange Unique?

Trusted by the world's most respected brands.

Faithfully serving IT professionals since 1996.

Related Solutions

Free Tech Articles

Cloud Class Webinars

Join the Community

Give a Little. Get a Lot.

Answers

3 Ways to Join

The Experts

The Experts

Testimonials

Testimonials

Testimonials

Business Clients

Business Clients

In the Press

In the Press

In the Press