Solved

Getting group and OU membership information from an endpoint machine

Posted on 2011-02-22
6
1,047 Views
Last Modified: 2012-05-11
Hello there!

Introduction (please forgive me if it's lengthy):
Our existing product runs on endpoint computers.
It's written in C# 2.0 (so we're talking about Win OS) and runs under SYSTEM credentials as a service.
We also have a server-side management program that, among other capabilities, displays the organizational domain tree using direct connection with the Directory Provider (either Active Directory or Novell).

However - now I wish to convert to a model where the server will not reside on a host inside the organization - so no more direct connection with the directory provider.

In order to still be able to construct the organizational domain tree I decided to solve this problem by adding information about the domain structure to the logs that my clients send.
(If you have a better idea please let me know - although this is not the question yet).

My problem is - how to get the domain info?
I made some attempts with LDAP and DirectoryServices libraries and managed to fetch all the information I need from the DC - but only when a user with sufficient credentials was logged on to the machine...
How can I write a code that runs on an endpoint machine as a service and can (at least) tell the group and OU membership of the machine - and of the logged on user?

Thanks a lot!
0
Comment
Question by:safendsupport
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
6 Comments
 
LVL 71

Expert Comment

by:Chris Dent
ID: 34950135

Hmm the client group membership should be exposed as a list of SIDs under the WindowsIdentity:

System.Security.Principal.WindowsIdentity.GetCurrent()

I suspect you can impersonate the System security context and pull the computer account as well. Can't say I've tried though.

The obvious disadvantage of that approach is that it shows SIDs, not group names. You'd need a connection to the directory to get names for the groups.

Chris
0
 

Author Comment

by:safendsupport
ID: 34950366
Thanks Chris,

I guess I can try and find a way to map those SIDs to group names (if I get them from other computers that managed to contact the server with LDAP queries).
What about OUs though?
I am trying to get to a point where I manage to get (at least) this information:
* Group membership (for machine and logged on user if exists)
* Machine full path (including all the OUs)
And do so without having sufficient credentials to contact the server with LDAP queries.

Thanks again!
0
 
LVL 71

Expert Comment

by:Chris Dent
ID: 34950642

Hmm well the client does have another possibility, the ADSystemInfo COM Object. That'll can give you the Distinguished Name for both user and computer.

However, this interface doesn't hold group information, none of that is cached locally beyond the group token seen in the WindowsIdentity object. To get group names you have no choice but to contact the directory.

Chris
0
Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 

Author Comment

by:safendsupport
ID: 34950709
Thanks again Chris - in that case one last followup question:
Do you know of any way to contact the directory when a local user is logged on to the computer?
Or even before log-in?
Is there any way to do so that is "nicer" then storing domain user credentials locally?
0
 
LVL 71

Accepted Solution

by:
Chris Dent earned 500 total points
ID: 34950821

Hmm you'd either need to authenticate the connection (and therefore store credentials), or enable anonymous access to the directory. Neither is particularly fun, and neither is really very nice.

Chris
0
 

Author Closing Comment

by:safendsupport
ID: 34950894
My many thanks to Chris for his help!
0

Featured Post

MS Dynamics Made Instantly Simpler

Make Your Microsoft Dynamics Investment Count  & Drastically Decrease Training Time by Providing Intuitive Step-By-Step WalkThru Tutorials.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article runs through the process of deploying a single EXE application selectively to a group of user.
This article explains the steps required to use the default Photos screensaver to display branding/corporate images
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

738 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question