How to get all the AD groups for a particular user?

Question

I checked this post already. But it doesn't answer my question. I want to get all the active directory groups in which a particular user is a member.

I've written the following code. But I'm not able to proceed further as I don't know how to give the filter and how to access the properties.

class Program {     static void Main(string[] args)     {         DirectoryEntry de = new DirectoryEntry("LDAP://mydomain.com");         DirectorySearcher searcher = new DirectorySearcher(de);         searcher.Filter = "(&(ObjectClass=group))";         searcher.PropertiesToLoad.Add("distinguishedName");         searcher.PropertiesToLoad.Add("sAMAccountName");         searcher.PropertiesToLoad.Add("name");         searcher.PropertiesToLoad.Add("objectSid");         SearchResultCollection results = searcher.FindAll();         int i = 1;         foreach (SearchResult res in results)         {             Console.WriteLine("Result" + Convert.ToString(i++));             DisplayProperties("distinguishedName", res);             DisplayProperties("sAMAccouontName", res);             DisplayProperties("name", res);             DisplayProperties("objectSid", res);             Console.WriteLine();         }          Console.ReadKey();     }      private static void DisplayProperties(string property, SearchResult res)     {         Console.WriteLine("\t" + property);         ResultPropertyValueCollection col = res.Properties[property];         foreach (object o in col)         {             Console.WriteLine("\t\t" + o.ToString());         }     } } 

Any ideas?

Answer 1

You should use System.DirectoryServices.AccountManagement. It's much easier. Here is a nice code project article giving you an overview on all the classes in this DLL.

As you pointed out, your current approach doesn't find out the primary group. Actually, it's much worse than you thought. There are some more cases that it doesn't work, like the domain local group from another domain. You can check here for details. Here is how the code looks like if you switch to use System.DirectoryServices.AccountManagement. The following code can find the immediate groups this user assigned to, which includes the primary group.

UserPrincipal user = UserPrincipal.FindByIdentity(new PrincipalContext (ContextType.Domain, "mydomain.com"), IdentityType.SamAccountName, "username"); foreach (GroupPrincipal group in user.GetGroups()) {     Console.Out.WriteLine(group); } 

Answer 2

Use tokenGroups:

DirectorySearcher ds = new DirectorySearcher(); ds.Filter = String.Format("(&(objectClass=user)(sAMAccountName={0}))", username); SearchResult sr = ds.FindOne();  DirectoryEntry user = sr.GetDirectoryEntry(); user.RefreshCache(new string[] { "tokenGroups" });  for (int i = 0; i < user.Properties["tokenGroups"].Count; i++) {     SecurityIdentifier sid = new SecurityIdentifier((byte[]) user.Properties["tokenGroups"][i], 0);     NTAccount nt = (NTAccount)sid.Translate(typeof(NTAccount));     //do something with the SID or name (nt.Value) } 

Note: this only gets security groups