Solved

Getting group and OU membership information from an endpoint machine

Posted on 2011-02-22
6
1,041 Views
Last Modified: 2012-05-11
Hello there!

Introduction (please forgive me if it's lengthy):
Our existing product runs on endpoint computers.
It's written in C# 2.0 (so we're talking about Win OS) and runs under SYSTEM credentials as a service.
We also have a server-side management program that, among other capabilities, displays the organizational domain tree using direct connection with the Directory Provider (either Active Directory or Novell).

However - now I wish to convert to a model where the server will not reside on a host inside the organization - so no more direct connection with the directory provider.

In order to still be able to construct the organizational domain tree I decided to solve this problem by adding information about the domain structure to the logs that my clients send.
(If you have a better idea please let me know - although this is not the question yet).

My problem is - how to get the domain info?
I made some attempts with LDAP and DirectoryServices libraries and managed to fetch all the information I need from the DC - but only when a user with sufficient credentials was logged on to the machine...
How can I write a code that runs on an endpoint machine as a service and can (at least) tell the group and OU membership of the machine - and of the logged on user?

Thanks a lot!
0
Comment
Question by:safendsupport
  • 3
  • 3
6 Comments
 
LVL 70

Expert Comment

by:Chris Dent
ID: 34950135

Hmm the client group membership should be exposed as a list of SIDs under the WindowsIdentity:

System.Security.Principal.WindowsIdentity.GetCurrent()

I suspect you can impersonate the System security context and pull the computer account as well. Can't say I've tried though.

The obvious disadvantage of that approach is that it shows SIDs, not group names. You'd need a connection to the directory to get names for the groups.

Chris
0
 

Author Comment

by:safendsupport
ID: 34950366
Thanks Chris,

I guess I can try and find a way to map those SIDs to group names (if I get them from other computers that managed to contact the server with LDAP queries).
What about OUs though?
I am trying to get to a point where I manage to get (at least) this information:
* Group membership (for machine and logged on user if exists)
* Machine full path (including all the OUs)
And do so without having sufficient credentials to contact the server with LDAP queries.

Thanks again!
0
 
LVL 70

Expert Comment

by:Chris Dent
ID: 34950642

Hmm well the client does have another possibility, the ADSystemInfo COM Object. That'll can give you the Distinguished Name for both user and computer.

However, this interface doesn't hold group information, none of that is cached locally beyond the group token seen in the WindowsIdentity object. To get group names you have no choice but to contact the directory.

Chris
0
 

Author Comment

by:safendsupport
ID: 34950709
Thanks again Chris - in that case one last followup question:
Do you know of any way to contact the directory when a local user is logged on to the computer?
Or even before log-in?
Is there any way to do so that is "nicer" then storing domain user credentials locally?
0
 
LVL 70

Accepted Solution

by:
Chris Dent earned 500 total points
ID: 34950821

Hmm you'd either need to authenticate the connection (and therefore store credentials), or enable anonymous access to the directory. Neither is particularly fun, and neither is really very nice.

Chris
0
 

Author Closing Comment

by:safendsupport
ID: 34950894
My many thanks to Chris for his help!
0

Join & Write a Comment

Calculating holidays and working days is a function that is often needed yet it is not one found within the Framework. This article presents one approach to building a working-day calculator for use in .NET.
In this article, we will see the basic design consideration while designing a Multi-tenant web application in a simple manner. Though, many frameworks are available in the market to develop a multi - tenant application, but do they provide data, cod…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now