Check AD group membership

  • Thread starter Thread starter Rob Oldfield
  • Start date Start date
R

Rob Oldfield

Does anyone have some code that will allow me to tell if the current user of
a windows forms app is in a particular AD group?

I've looked at the IsInRole way of doing it, using something like this....

Private Function InGroup(ByVal grp As String) As Boolean
Dim id As WindowsIdentity
id = WindowsIdentity.GetCurrent()
Dim p As New WindowsPrincipal(id)
InGroup = p.IsInRole("DomainName\" + grp)
End Function

....but that only works for built-in groups like Domain Users and Domain
Admins (do I have that correct?) so is of no use to me. The groups I want
to check are custom made new ones.

I've also looked at something like this...

Dim entry As New DirectoryServices.DirectoryEntry(LDAP://Domain_Name)
Dim mySearcher As New System.DirectoryServices.DirectorySearcher(entry)
Dim result As System.DirectoryServices.SearchResult
mySearcher.Filter = ("(anr= MyGroupName)")

....which gets me the correct security group, but I'm then stuck on how I can
get at its members.

Any ideas would be most appreciated.
 
Rob,

I don't see a mistake in your code but IsInRole also works for custom roles.
I use that function a lot with non built-in groups.

Regards,

--

Nico Debeuckelaere

ND-Sign BVBA (Microsoft Certified Partner since 2004)
Pierstraat 135
B-2840 Rumst
URL: http://www.nd-sign.com
== ND-Sign, Designed for you ==
(This posting is provided "AS IS", with no warranties, and confers no
rights.)
 
Thanks for the info Nico, but I still can't get it to work properly. I have
actually found a non-built in group that reports my membership correctly,
but if I copy that group and check the new group then my function is
reporting incorrectly. Do you know if there is any limitation on the groups
that this works with - 'not in lower level OUs' or 'pre Win 2K name has to
be the same as the Win 2K name' kind of thing?

Thanks again.
 
OK. Problem solved. I was working on a machine over a WAN connection to
the main DC. Looks like I just wasn't leaving it long enough for changes in
group membership to filter down (even though I was checking my local copy of
ADUC before expecting it to work). Just installed a dummy app onto a
machine connected via LAN to the main DC and everything works fine.

Thanks for keeping me on the right lines Nico. Very useful to know that my
code worked elsewhere.
 
My pleasure ;0)

Rob Oldfield said:
OK. Problem solved. I was working on a machine over a WAN connection to
the main DC. Looks like I just wasn't leaving it long enough for changes in
group membership to filter down (even though I was checking my local copy of
ADUC before expecting it to work). Just installed a dummy app onto a
machine connected via LAN to the main DC and everything works fine.

Thanks for keeping me on the right lines Nico. Very useful to know that my
code worked elsewhere.
Click to expand...
 
Back
Top