How to retrieve each members in an AD Security Group?

Posted on 2014-12-17
Last Modified: 2014-12-18
Hi, I'm using VS2012, C# and
Hi, I need to retrieve all members of a Security group.  Basically all windows account in a users group.  I then list about 6 attribute information from each account on a row in a Gridview control and allow for certain update.  After some struggle, I am now able to get pass authentication.  need help with syntax on binding to the Security group and then how to retrieve each member's information.   This is what I have below.  Got exception error when it executes the code "object members = deAccounts.Invoke("members", null);".
Got error message "{"A referral was returned from the server.\r\n"}"
Q: Is my binding correctly for binding to a security group in AD?
Also why it crash and how to fix it?  Thank you.

                DirectoryEntry deAccounts = new DirectoryEntry("LDAP://,DC=my,DC=domain,DC=com", @"", "MyPassword");

                if (deAccounts != null)

                    object members = deAccounts.Invoke("members", null);

                    foreach (object groupMember in (IEnumerable<object>)members)
                        DirectoryEntry member = new DirectoryEntry(groupMember);


                    gridAccounts.DataSource = genericAccounts;

Question by:lapucca
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3

Author Comment

ID: 40505859
Well, I just saw that I still have error after binding to both root and a security group, here is the error below.  I get this error when I expanded both the root bind and the direct bind to the Security group.  

            HResult      -2147467262      int
+            InnerException      null      System.Exception
            Message      "Unable to cast COM object of type 'System.__ComObject' to interface type 'IAdsContainer'. This operation failed because the QueryInterface call on the COM component for the interface with IID '{001677D0-FD16-11CE-ABC4-02608C9E7553}' failed due to the following error: No such interface supported (Exception from HRESULT: 0x80004002 (E_NOINTERFACE))."      string
            Source      "System.DirectoryServices"      string
            StackTrace      "   at System.DirectoryServices.DirectoryEntry.get_ContainerObject()"      string
+            TargetSite      {IAdsContainer get_ContainerObject()}      System.Reflection.MethodBase {System.Reflection.RuntimeMethodInfo}
LVL 71

Expert Comment

by:Chris Dent
ID: 40506706
You could search for them instead. That'll leave you with a SearchResultCollection you can easily loop through without worrying about the COMObject at all.

DirectorySearcher searcher = new DirectorySearcher("(memberOf=CN=admin_id,DC=my,DC=domain,DC=com)");
searcher.PageSize = 1000;
SearchResultCollection results = searcher.FindAll();

Open in new window

Alternatively you can cast the COMObject returned by the member method to a DirectoryEntry (note that the member method does not return an exact copy of the member attribute).

DirectoryEntry entry = (DirectoryEntry)member;

Open in new window

LVL 71

Expert Comment

by:Chris Dent
ID: 40506707
Sorry, missed a note.

If you've doing this for large groups and don't need to write back to the directory the first method (DirectorySearcher) is, by far, the most efficient. For the second method you have to re-bind to the directory for every member to get the properties.

Free learning courses: Active Directory Deep Dive

Get a firm grasp on your IT environment when you learn Active Directory best practices with Veeam! Watch all, or choose any amount, of this three-part webinar series to improve your skills. From the basics to virtualization and backup, we got you covered.


Author Comment

ID: 40507343
Yes, I would allso user to make changes to the 6 members properties, including enabling and disabling the account.  That change will need to be updated back to AD.

I need to bind about 6 attribute, property , for each member in that group.  Right now we expect only abut 30 members the most.  Please advise what is the best way to do this.  The code I posted is taken from MS site,
The code gets an exception when it uses the Invoke method.  With error saying that "{"A referral was returned from the server.\r\n"}".  Why am I getting this message?  It couldn't find it or is the service account not having the permission?

The COM object error is after the DE is created and I expand in the debug window to examine its properties.  Would like to know why I'm getting that error as well or do I just ignore that?  Am I bind to AD even with this code?
Thank you.
LVL 71

Accepted Solution

Chris Dent earned 500 total points
ID: 40507354
Referral means the object, or partition, is hosted elsewhere in the forest. You can chase referrals, but I'll need to pull some samples from my library to show you that.

Let me try and have a look at the link in the morning. Home time but my net connection is down at home for a few days.


Author Comment

ID: 40508081
There were a couple of issues that attributed the problem.  The major one is permission weren't set properly for that service account.  I've gotten over those errors.  Now I'm having problem getting member of that Security Group and binding that to the gridview control.  I'll post that in another question.  Thank you much for your help.

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A project that enables an administrator to perform actions within a user session context not just at the time of login but any time later on day(s) or week(s) later.
Active Directory security has been a hot topic of late, and for good reason. With 90% of the world’s organization using this system to manage access to all parts of their IT infrastructure, knowing how to protect against threats and keep vulnerabil…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

734 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question