VB replacement of ifmember.exe /list

Posted on 2006-05-23
Last Modified: 2008-01-09
I try to convert a logon script to VB, but i could not find an equivalent function for the IFMEMBER.EXE.

To script is completely based on the array of group memberships the ifmember /list returns.

Therefore I need a function in vb, that returns such an array as simple as ifmember /list does.

I do not want to care about or predefine in which domain or ou the user is, all must to relate to the current user.

I saw a lot of AD-Scripting and LDAP stuff, but could not find something that simply returns all groups the current user belongs to without predefine at least the LDAP domain.

Anyone have an idea?
Question by:Gryzn

    Author Comment

    I see, that this will give me what I want:

    arrMemberOf = objUser.GetEx("memberOf")

    ... but still don't know, how to get an user object from the current user...
    LVL 14

    Expert Comment

    That's a tricky question.  ifmember /list reads your access token to include EVERY group SID you are a member of, including nested groups, built-in security principals (like EVERYONE, INTERACTIVE, and Authenticated Users) which you won't get if you just query the user object's memberOf attribute.

    There is another Microsoft command line utility that provides info very similar to ifmember:  whoami.exe

    whoami /GROUPS

    will dump much the same list as ifmember.  If you absolutely need this to be in a VBScript LDAP search, I would recommend starting with one of Richard Mueller's sample scripts ( under "Free VBScript Code", "Group Membership Tests".  He has several versions of this type of script demonstrating different techniques, each with slightly different advantages and disadvantages.

    But a compiled application that reads your access token directly is definitely the most efficient way to get this info (like ifmember or whoami).


    Author Comment

    Thanks for the hints dlwyatt82.

    Frankly, I  don't really need all of the information ifmember /list returns.

    In the AD is an OU "LoginControl" which contains global groups, neesting possible. I just need these groups the current user is member of. But the OU name LoginControl is the only constant allowed. It must work on every domain.

    The problem of all the samples around is, that it is all based on "is a user a member of a KNOWN group". But I need to RETRIEVE the names of groups, which I don't know. This is because, the group names itself contains the action to do in the script. Different approach..

    The main reason I cannot use an external program is: I do not have a guaranteed space to write to output to....

    But I will study the samples of rlmueller, maybe I find a solution for me.
    LVL 14

    Accepted Solution

    I see.  Well, Richard Mueller's examples pretty much cover all the bases (with some solution handling nested groups, cross-domain nested groups, Primary Group, etc).  On that subject, a user's Primary Group is kind of a strange attribute, but 'most' of the time, that will just be Domain Users anyway.  Only legacy POSIX style applications might require the Primary Group to be changed.

    But you do have the right idea to start with.  Querying a user's "memberOf" attribute will give you a list of the groups they are directly a member of (not nested), minus the primary group.  Here's an example of how you can obtain this basic information from Active Directory if you only know the user's login name:


    Dim strLogin
    Dim strDomainDN
    Dim strGroup
    Dim objAdoCon, objAdoCmd, objAdoRS

    strLogin = "UserName"
    ' (You can obtain this however you like.  For this example,
    ' it's hard coded).

    strDomainDN = "dc=company,dc=com"
    ' You AD domain's distinguished name.  Again hard coded
    ' for simplicity in this example.

    Set objAdoCon = CreateObject("ADODB.Connection")
    Set objAdoCmd = CreateObject("ADODB.Command")

    objAdoCon.Open "Provider=ADsDSOObject;"
    Set objAdoCmd.ActiveConnection = objAdoCon

    objAdoCmd.CommandText = _
      "SELECT memberOf FROM 'LDAP://" & strDomainDN & "' " & _
      "WHERE objectCategory='person' AND objectClass='user' AND " & _
      "sAMAccountName='" & strLogin & "'"

    Set objAdoRS = objAdoCmd.Execute

    Do While (Not objAdoRS.EOF)
      WScript.Echo Join(objAdoRS("memberOf"), vbCrLf)

    Author Comment

    Sorry for leaving this question orphaned. I couldn't find the time to test the suggestions yet, but will do in the next few days and feeding back.

    Author Comment


    Thanks for your input. Even I was not able to re-create the full funcionality of IFMEMBER, I've got the all information that I need for my generic login script.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Highfive + Dolby Voice = No More Audio Complaints!

    Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

    Introduction This article makes the case for using two modules in your VBA/VB6 applications to provide both case-sensitive and case-insensitive text comparison operations.  Recently, I solved an EE question using the LIKE function.  In order for th…
    The debugging module of the VB 6 IDE can be accessed by way of the Debug menu item. That menu item can normally be found in the IDE's main menu line as shown in this picture.   There is also a companion Debug Toolbar that looks like the followin…
    Get people started with the process of using Access VBA to control Outlook using automation, Microsoft Access can control other applications. An example is the ability to programmatically talk to Microsoft Outlook. Using automation, an Access applic…
    Get people started with the process of using Access VBA to control Excel using automation, Microsoft Access can control other applications. An example is the ability to programmatically talk to Excel. Using automation, an Access application can laun…

    760 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    7 Experts available now in Live!

    Get 1:1 Help Now