Solved

How to retrieve each members in an AD Security Group?

Posted on 2014-12-17
6
286 Views
Last Modified: 2014-12-18
Hi, I'm using VS2012, C# and asp.net.
Hi, I need to retrieve all members of a Security group.  Basically all windows account in a users group.  I then list about 6 attribute information from each account on a row in a Gridview control and allow for certain update.  After some struggle, I am now able to get pass authentication.  need help with syntax on binding to the Security group and then how to retrieve each member's information.   This is what I have below.  Got exception error when it executes the code "object members = deAccounts.Invoke("members", null);".
Got error message "{"A referral was returned from the server.\r\n"}"
Q: Is my binding correctly for binding to a security group in AD?
Also why it crash and how to fix it?  Thank you.



                DirectoryEntry deAccounts = new DirectoryEntry("LDAP://my.domain.com/CN=admin_id,DC=my,DC=domain,DC=com", @"admin_id@my.domain.com", "MyPassword");

                if (deAccounts != null)
                {
                 

                   
                    object members = deAccounts.Invoke("members", null);

                    foreach (object groupMember in (IEnumerable<object>)members)
                    {
                        DirectoryEntry member = new DirectoryEntry(groupMember);
                        genericAccounts.Add(member);

                        Console.WriteLine(member.Name);
                    }

                    gridAccounts.DataSource = genericAccounts;
                    gridAccounts.DataBind();

                }
0
Comment
Question by:lapucca
  • 3
  • 3
6 Comments
 

Author Comment

by:lapucca
ID: 40505859
Well, I just saw that I still have error after binding to both root and a security group, here is the error below.  I get this error when I expanded both the root bind and the direct bind to the Security group.  


            HResult      -2147467262      int
+            InnerException      null      System.Exception
            Message      "Unable to cast COM object of type 'System.__ComObject' to interface type 'IAdsContainer'. This operation failed because the QueryInterface call on the COM component for the interface with IID '{001677D0-FD16-11CE-ABC4-02608C9E7553}' failed due to the following error: No such interface supported (Exception from HRESULT: 0x80004002 (E_NOINTERFACE))."      string
            Source      "System.DirectoryServices"      string
            StackTrace      "   at System.DirectoryServices.DirectoryEntry.get_ContainerObject()"      string
+            TargetSite      {IAdsContainer get_ContainerObject()}      System.Reflection.MethodBase {System.Reflection.RuntimeMethodInfo}
0
 
LVL 71

Expert Comment

by:Chris Dent
ID: 40506706
You could search for them instead. That'll leave you with a SearchResultCollection you can easily loop through without worrying about the COMObject at all.

e.g.
DirectorySearcher searcher = new DirectorySearcher("(memberOf=CN=admin_id,DC=my,DC=domain,DC=com)");
searcher.PageSize = 1000;
SearchResultCollection results = searcher.FindAll();

Open in new window

Alternatively you can cast the COMObject returned by the member method to a DirectoryEntry (note that the member method does not return an exact copy of the member attribute).

e.g.
DirectoryEntry entry = (DirectoryEntry)member;

Open in new window

Chris
0
 
LVL 71

Expert Comment

by:Chris Dent
ID: 40506707
Sorry, missed a note.

If you've doing this for large groups and don't need to write back to the directory the first method (DirectorySearcher) is, by far, the most efficient. For the second method you have to re-bind to the directory for every member to get the properties.

Chris
0
Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

 

Author Comment

by:lapucca
ID: 40507343
Chris,
Yes, I would allso user to make changes to the 6 members properties, including enabling and disabling the account.  That change will need to be updated back to AD.

I need to bind about 6 attribute, property , for each member in that group.  Right now we expect only abut 30 members the most.  Please advise what is the best way to do this.  The code I posted is taken from MS site, http://msdn.microsoft.com/en-us/library/ms180906%28v=vs.80%29.aspx
The code gets an exception when it uses the Invoke method.  With error saying that "{"A referral was returned from the server.\r\n"}".  Why am I getting this message?  It couldn't find it or is the service account not having the permission?

The COM object error is after the DE is created and I expand in the debug window to examine its properties.  Would like to know why I'm getting that error as well or do I just ignore that?  Am I bind to AD even with this code?
Thank you.
0
 
LVL 71

Accepted Solution

by:
Chris Dent earned 500 total points
ID: 40507354
Referral means the object, or partition, is hosted elsewhere in the forest. You can chase referrals, but I'll need to pull some samples from my library to show you that.

Let me try and have a look at the link in the morning. Home time but my net connection is down at home for a few days.

Chris
0
 

Author Comment

by:lapucca
ID: 40508081
There were a couple of issues that attributed the problem.  The major one is permission weren't set properly for that service account.  I've gotten over those errors.  Now I'm having problem getting member of that Security Group and binding that to the gridview control.  I'll post that in another question.  Thank you much for your help.
0

Featured Post

Is Your AD Toolbox Looking More Like a Toybox?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

In this article, I am going to show you how to simulate a multi-site Lab environment on a single Hyper-V host. I use this method successfully in my own lab to simulate three fully routed global AD Sites on a Windows 10 Hyper-V host.
This article demonstrates probably the easiest way to configure domain-wide tier isolation within Active Directory. If you do not know tier isolation read https://technet.microsoft.com/en-us/windows-server-docs/security/securing-privileged-access/s…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

680 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question