Question

I want to get all the Active Directory groups in which a particular user is a member.

I do have the script to get all the immediate AD groups for a user (see codes below).

However, how do I get all the parent groups for each of the immediate AD groups the user belongs to?

e.g. I am directly part of the AD group called IT Team Managers. This group is member of a parent group called IT Team National etc. How do I get this parent group from my code?

Thanks so much in advance!

DirectorySearcher ouSearch = new DirectorySearcher(entry);
ouSearch.Filter = "(&(objectClass=User)(sAMAccountName=" + username + "))";

//ouSearch.PropertiesToLoad.Add("samAccountName");
ouSearch.PropertiesToLoad.Add("memberOf");
ouSearch.SearchScope = SearchScope.Subtree;

SearchResult allOUS = ouSearch.FindOne();

//foreach (string g in allOUS.Properties["memberOf"])
{
    equalsIndex = g.IndexOf("=", 1);
    commaIndex = g.IndexOf(",", 1);

    if (equalsIndex == -1)
    {
       return null;
    }

    groupNames.Append(g.Substring((equalsIndex + 1), (commaIndex - equalsIndex) - 1));
    groupNames.Append(",");
}

Answer 1

If you’re on .NET 3.5 and up, you should check out the System.DirectoryServices.AccountManagement (S.DS.AM) namespace. Read all about it here:

• Managing Directory Security Principals in the .NET Framework 3.5
• MSDN docs on System.DirectoryServices.AccountManagement

Basically, you can define a domain context and easily find users and/or groups in AD:

// set up domain context
PrincipalContext ctx = new PrincipalContext(ContextType.Domain);

// find a user
UserPrincipal user = UserPrincipal.FindByIdentity(ctx, "SomeUserName");

if(user != null)
{
   // get the "authorization groups" the user is a member of - recursively
   var authGroups = user.GetAuthorizationGroups();

   // iterate over groups
   foreach(Principal p in authGroups)
   {
      // do something with groups ....       
   }
}

The new S.DS.AM makes it really easy to play around with users and groups in AD!