Link to home
Start Free TrialLog in
Avatar of Gryzn
Gryzn

asked on

VB replacement of ifmember.exe /list

I try to convert a logon script to VB, but i could not find an equivalent function for the IFMEMBER.EXE.

To script is completely based on the array of group memberships the ifmember /list returns.

Therefore I need a function in vb, that returns such an array as simple as ifmember /list does.

I do not want to care about or predefine in which domain or ou the user is, all must to relate to the current user.

I saw a lot of AD-Scripting and LDAP stuff, but could not find something that simply returns all groups the current user belongs to without predefine at least the LDAP domain.

Anyone have an idea?
Avatar of Gryzn
Gryzn

ASKER

I see, that this will give me what I want:

arrMemberOf = objUser.GetEx("memberOf")

... but still don't know, how to get an user object from the current user...
That's a tricky question.  ifmember /list reads your access token to include EVERY group SID you are a member of, including nested groups, built-in security principals (like EVERYONE, INTERACTIVE, and Authenticated Users) which you won't get if you just query the user object's memberOf attribute.

There is another Microsoft command line utility that provides info very similar to ifmember:  whoami.exe

whoami /GROUPS

will dump much the same list as ifmember.  If you absolutely need this to be in a VBScript LDAP search, I would recommend starting with one of Richard Mueller's sample scripts (www.rlmueller.net) under "Free VBScript Code", "Group Membership Tests".  He has several versions of this type of script demonstrating different techniques, each with slightly different advantages and disadvantages.

But a compiled application that reads your access token directly is definitely the most efficient way to get this info (like ifmember or whoami).

Avatar of Gryzn

ASKER

Thanks for the hints dlwyatt82.

Frankly, I  don't really need all of the information ifmember /list returns.

In the AD is an OU "LoginControl" which contains global groups, neesting possible. I just need these groups the current user is member of. But the OU name LoginControl is the only constant allowed. It must work on every domain.

The problem of all the samples around is, that it is all based on "is a user a member of a KNOWN group". But I need to RETRIEVE the names of groups, which I don't know. This is because, the group names itself contains the action to do in the script. Different approach..

The main reason I cannot use an external program is: I do not have a guaranteed space to write to output to....

But I will study the samples of rlmueller, maybe I find a solution for me.
ASKER CERTIFIED SOLUTION
Avatar of dlwyatt82
dlwyatt82
Flag of Canada image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of Gryzn

ASKER

Sorry for leaving this question orphaned. I couldn't find the time to test the suggestions yet, but will do in the next few days and feeding back.
Avatar of Gryzn

ASKER

@dlwyatt82

Thanks for your input. Even I was not able to re-create the full funcionality of IFMEMBER, I've got the all information that I need for my generic login script.