?
Solved

Getting group and OU membership information from an endpoint machine

Posted on 2011-02-22
6
Medium Priority
?
1,056 Views
Last Modified: 2012-05-11
Hello there!

Introduction (please forgive me if it's lengthy):
Our existing product runs on endpoint computers.
It's written in C# 2.0 (so we're talking about Win OS) and runs under SYSTEM credentials as a service.
We also have a server-side management program that, among other capabilities, displays the organizational domain tree using direct connection with the Directory Provider (either Active Directory or Novell).

However - now I wish to convert to a model where the server will not reside on a host inside the organization - so no more direct connection with the directory provider.

In order to still be able to construct the organizational domain tree I decided to solve this problem by adding information about the domain structure to the logs that my clients send.
(If you have a better idea please let me know - although this is not the question yet).

My problem is - how to get the domain info?
I made some attempts with LDAP and DirectoryServices libraries and managed to fetch all the information I need from the DC - but only when a user with sufficient credentials was logged on to the machine...
How can I write a code that runs on an endpoint machine as a service and can (at least) tell the group and OU membership of the machine - and of the logged on user?

Thanks a lot!
0
Comment
Question by:safendsupport
  • 3
  • 3
6 Comments
 
LVL 71

Expert Comment

by:Chris Dent
ID: 34950135

Hmm the client group membership should be exposed as a list of SIDs under the WindowsIdentity:

System.Security.Principal.WindowsIdentity.GetCurrent()

I suspect you can impersonate the System security context and pull the computer account as well. Can't say I've tried though.

The obvious disadvantage of that approach is that it shows SIDs, not group names. You'd need a connection to the directory to get names for the groups.

Chris
0
 

Author Comment

by:safendsupport
ID: 34950366
Thanks Chris,

I guess I can try and find a way to map those SIDs to group names (if I get them from other computers that managed to contact the server with LDAP queries).
What about OUs though?
I am trying to get to a point where I manage to get (at least) this information:
* Group membership (for machine and logged on user if exists)
* Machine full path (including all the OUs)
And do so without having sufficient credentials to contact the server with LDAP queries.

Thanks again!
0
 
LVL 71

Expert Comment

by:Chris Dent
ID: 34950642

Hmm well the client does have another possibility, the ADSystemInfo COM Object. That'll can give you the Distinguished Name for both user and computer.

However, this interface doesn't hold group information, none of that is cached locally beyond the group token seen in the WindowsIdentity object. To get group names you have no choice but to contact the directory.

Chris
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

 

Author Comment

by:safendsupport
ID: 34950709
Thanks again Chris - in that case one last followup question:
Do you know of any way to contact the directory when a local user is logged on to the computer?
Or even before log-in?
Is there any way to do so that is "nicer" then storing domain user credentials locally?
0
 
LVL 71

Accepted Solution

by:
Chris Dent earned 2000 total points
ID: 34950821

Hmm you'd either need to authenticate the connection (and therefore store credentials), or enable anonymous access to the directory. Neither is particularly fun, and neither is really very nice.

Chris
0
 

Author Closing Comment

by:safendsupport
ID: 34950894
My many thanks to Chris for his help!
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Group policies can be applied selectively to specific devices with the help of groups. Utilising this, it is possible to phase-in group policies, over a period of time, by randomly adding non-members user or computers at a set interval, to a group f…
How to deal with a specific error when using the Enable-RemoteMailbox cmdlet to create a mailbox in the cloud-based service, for an existing user in an on-premises Active Directory.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
Suggested Courses

621 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question