Solved

Visual Basic 2008 Active Directory Group Membrship

Posted on 2008-09-29
7
1,058 Views
Last Modified: 2012-03-15
I have an application I'm creating that when a user starts I want to check an security group in AD to verify the users membership.  I was able to create the routines to get the domain & UserID by the workstation login so now i just need a process for comparing a user to a AD group.

Thanks in advance!

Michael
0
Comment
Question by:MKC06
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
7 Comments
 
LVL 5

Expert Comment

by:minvis
ID: 22603184
If you don't mind using a commandline tool in you script: Dsquery and Dsmod

Dsquery is to get an object from AD and Dsget if for getting a property of the object.
So if you want to know who is member of the the domain admins try:
dsquery group -name "domain admins" | dsget group -members

I hope thios works for you. Good luck!
0
 
LVL 71

Expert Comment

by:Chris Dent
ID: 22604537

Hi Michael,

That should be fine. Can we a ssume the program is running as an authenticated user?

If so, we have System.DirectoryServices. We can use that to find the user in AD and grab the group membership (memberOf). Presumably you'd like samples? ;)

Chris
0
 

Author Comment

by:MKC06
ID: 22605483
Hi Chris,

Yes,if you have an example that would be great, I'm just not sure how to construct the code.  For example, I have the user name captured in a variable called strGetUserID, and the domain strDomain, I want to validate the user against an AD group called a_Synapse_Admins.

Thank you,

Michael
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 71

Accepted Solution

by:
Chris Dent earned 500 total points
ID: 22605972

Hi Michael,

Before I post a lot I have to add a little note. I'm not a programmer at all, I work with AD and know how to do a lot of these things. However, my way might not necessarily the best way (just so you know :)).

Anyway, that said... here's a simple way of finding and retrieving group membership for a single user.

I can't attach a project, perhaps imagine a form with three buttons: Username, GroupName and DomainName (e.g. domain.com). The sub just writes  the result of a quick search to another text box, default value is false, but it if does a basic match that becomes true.

Chris
    Private Sub MemberOf_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MemberOf.Click
 
        Dim rootDSE As New DirectoryEntry("LDAP://" & DomainName.Text & "/RootDSE")
 
        Dim filterString As String = "(&(objectClass=user)(objectCategory=person)(sAMAccountName=" & Username.Text & "))"
        Dim domainRoot As New DirectoryEntry("LDAP://" & DomainName.Text & "/" & rootDSE.Properties("defaultNamingContext")(0).ToString())
        Dim domainSearch As New DirectorySearcher(domainRoot, filterString)
        domainSearch.PropertiesToLoad.Add("memberOf")
 
        Dim domainSearchResult As SearchResult = domainSearch.FindOne()
 
        Results.Text = "MemberOf: False"
        For Each domainGroup In domainSearchResult.Properties("memberof")
            If InStr(domainGroup, GroupName.Text) > 0 Then
                Results.Text = "MemberOf: True"
                Exit For
            End If
        Next
    End Sub

Open in new window

0
 

Author Comment

by:MKC06
ID: 22606783
That works perfectly Chris!, thank you so much.  Below is the code I came up with for my project
        'Check AD group member ship in the A_Synapse_Admins AD group
        'Returns True if the userid is a synapse Admin
        Dim rootDSE As New DirectoryEntry("LDAP://" & rDomain() & "/RootDSE")
        Dim strGroupName As String
 
        Dim filterString As String = "(&(objectClass=user)(objectCategory=person)(sAMAccountName=" & rGetUserName() & "))"
        Dim domainRoot As New DirectoryEntry("LDAP://" & rDomain() & "/" & rootDSE.Properties("defaultNamingContext")(0).ToString())
        Dim domainSearch As New DirectorySearcher(domainRoot, filterString)
        domainSearch.PropertiesToLoad.Add("memberOf")
 
        Dim domainSearchResult As SearchResult = domainSearch.FindOne()
        strGroupName = "a_Synapse_Admins"
        sResults.Text = "MemberOf: False"
        For Each domainGroup In domainSearchResult.Properties("memberof")
            If InStr(domainGroup, strGroupName) > 0 Then
                sResults.Text = "MemberOf: True"
                Exit For
            End If

Open in new window

0
 

Author Closing Comment

by:MKC06
ID: 31501468
Thanks again!
0
 
LVL 71

Expert Comment

by:Chris Dent
ID: 22606813

Glad I could help out :)

Chris
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A company’s centralized system that manages user data, security, and distributed resources is often a focus of criminal attention. Active Directory (AD) is no exception. In truth, it’s even more likely to be targeted due to the number of companies …
Auditing domain password hashes is a commonly overlooked but critical requirement to ensuring secure passwords practices are followed. Methods exist to extract hashes directly for a live domain however this article describes a process to extract u…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question