Getting group and OU membership information from an endpoint machine

Hello there!

Introduction (please forgive me if it's lengthy):
Our existing product runs on endpoint computers.
It's written in C# 2.0 (so we're talking about Win OS) and runs under SYSTEM credentials as a service.
We also have a server-side management program that, among other capabilities, displays the organizational domain tree using direct connection with the Directory Provider (either Active Directory or Novell).

However - now I wish to convert to a model where the server will not reside on a host inside the organization - so no more direct connection with the directory provider.

In order to still be able to construct the organizational domain tree I decided to solve this problem by adding information about the domain structure to the logs that my clients send.
(If you have a better idea please let me know - although this is not the question yet).

My problem is - how to get the domain info?
I made some attempts with LDAP and DirectoryServices libraries and managed to fetch all the information I need from the DC - but only when a user with sufficient credentials was logged on to the machine...
How can I write a code that runs on an endpoint machine as a service and can (at least) tell the group and OU membership of the machine - and of the logged on user?

Thanks a lot!
safendsupportAsked:
Who is Participating?
 
Chris DentConnect With a Mentor PowerShell DeveloperCommented:

Hmm you'd either need to authenticate the connection (and therefore store credentials), or enable anonymous access to the directory. Neither is particularly fun, and neither is really very nice.

Chris
0
 
Chris DentPowerShell DeveloperCommented:

Hmm the client group membership should be exposed as a list of SIDs under the WindowsIdentity:

System.Security.Principal.WindowsIdentity.GetCurrent()

I suspect you can impersonate the System security context and pull the computer account as well. Can't say I've tried though.

The obvious disadvantage of that approach is that it shows SIDs, not group names. You'd need a connection to the directory to get names for the groups.

Chris
0
 
safendsupportAuthor Commented:
Thanks Chris,

I guess I can try and find a way to map those SIDs to group names (if I get them from other computers that managed to contact the server with LDAP queries).
What about OUs though?
I am trying to get to a point where I manage to get (at least) this information:
* Group membership (for machine and logged on user if exists)
* Machine full path (including all the OUs)
And do so without having sufficient credentials to contact the server with LDAP queries.

Thanks again!
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

 
Chris DentPowerShell DeveloperCommented:

Hmm well the client does have another possibility, the ADSystemInfo COM Object. That'll can give you the Distinguished Name for both user and computer.

However, this interface doesn't hold group information, none of that is cached locally beyond the group token seen in the WindowsIdentity object. To get group names you have no choice but to contact the directory.

Chris
0
 
safendsupportAuthor Commented:
Thanks again Chris - in that case one last followup question:
Do you know of any way to contact the directory when a local user is logged on to the computer?
Or even before log-in?
Is there any way to do so that is "nicer" then storing domain user credentials locally?
0
 
safendsupportAuthor Commented:
My many thanks to Chris for his help!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.