Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Getting group and OU membership information from an endpoint machine

Posted on 2011-02-22
6
Medium Priority
?
1,054 Views
Last Modified: 2012-05-11
Hello there!

Introduction (please forgive me if it's lengthy):
Our existing product runs on endpoint computers.
It's written in C# 2.0 (so we're talking about Win OS) and runs under SYSTEM credentials as a service.
We also have a server-side management program that, among other capabilities, displays the organizational domain tree using direct connection with the Directory Provider (either Active Directory or Novell).

However - now I wish to convert to a model where the server will not reside on a host inside the organization - so no more direct connection with the directory provider.

In order to still be able to construct the organizational domain tree I decided to solve this problem by adding information about the domain structure to the logs that my clients send.
(If you have a better idea please let me know - although this is not the question yet).

My problem is - how to get the domain info?
I made some attempts with LDAP and DirectoryServices libraries and managed to fetch all the information I need from the DC - but only when a user with sufficient credentials was logged on to the machine...
How can I write a code that runs on an endpoint machine as a service and can (at least) tell the group and OU membership of the machine - and of the logged on user?

Thanks a lot!
0
Comment
Question by:safendsupport
  • 3
  • 3
6 Comments
 
LVL 71

Expert Comment

by:Chris Dent
ID: 34950135

Hmm the client group membership should be exposed as a list of SIDs under the WindowsIdentity:

System.Security.Principal.WindowsIdentity.GetCurrent()

I suspect you can impersonate the System security context and pull the computer account as well. Can't say I've tried though.

The obvious disadvantage of that approach is that it shows SIDs, not group names. You'd need a connection to the directory to get names for the groups.

Chris
0
 

Author Comment

by:safendsupport
ID: 34950366
Thanks Chris,

I guess I can try and find a way to map those SIDs to group names (if I get them from other computers that managed to contact the server with LDAP queries).
What about OUs though?
I am trying to get to a point where I manage to get (at least) this information:
* Group membership (for machine and logged on user if exists)
* Machine full path (including all the OUs)
And do so without having sufficient credentials to contact the server with LDAP queries.

Thanks again!
0
 
LVL 71

Expert Comment

by:Chris Dent
ID: 34950642

Hmm well the client does have another possibility, the ADSystemInfo COM Object. That'll can give you the Distinguished Name for both user and computer.

However, this interface doesn't hold group information, none of that is cached locally beyond the group token seen in the WindowsIdentity object. To get group names you have no choice but to contact the directory.

Chris
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 

Author Comment

by:safendsupport
ID: 34950709
Thanks again Chris - in that case one last followup question:
Do you know of any way to contact the directory when a local user is logged on to the computer?
Or even before log-in?
Is there any way to do so that is "nicer" then storing domain user credentials locally?
0
 
LVL 71

Accepted Solution

by:
Chris Dent earned 2000 total points
ID: 34950821

Hmm you'd either need to authenticate the connection (and therefore store credentials), or enable anonymous access to the directory. Neither is particularly fun, and neither is really very nice.

Chris
0
 

Author Closing Comment

by:safendsupport
ID: 34950894
My many thanks to Chris for his help!
0

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Compliance and data security require steps be taken to prevent unauthorized users from copying data.  Here's one method to prevent data theft via USB drives (and writable optical media).
High user turnover can cause old/redundant user data to consume valuable space. UserResourceCleanup was developed to address this by automatically deleting user folders when the user account is deleted.
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
This video shows how to use Hyena, from SystemTools Software, to update 100 user accounts from an external text file. View in 1080p for best video quality.

885 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question