Question

I’m trying to find an AD query to test if User A is part of Group B.

User A is member of Group A which is member of Group B; hence, User A is really a member of Group B.

I have tried looking at the information from http://msdn.microsoft.com/en-us/library/aa746475%28VS.85%29.aspx, but this looks like it’s starting the search from the User and going down. I need to be able to start from the Group and crawl the child objects.

Answer 1

If you’re on .NET 3.5 and up, and using VB.NET or C# as your programming language, you should check out the System.DirectoryServices.AccountManagement (S.DS.AM) namespace. Read all about it here:

• Managing Directory Security Principals in the .NET Framework 3.5
• MSDN docs on System.DirectoryServices.AccountManagement

Basically, you can define a domain context and easily find users and/or groups in AD:

// set up domain context
PrincipalContext ctx = new PrincipalContext(ContextType.Domain);

// find a user
UserPrincipal user = UserPrincipal.FindByIdentity(ctx, "SomeUserName");

if(user != null)
{
   // find the group in question
   GroupPrincipal group = GroupPrincipal.FindByIdentity(ctx, "YourGroupNameHere");

   if(group != null)
   {
      bool isUserMemberOfThatGroup = user.IsMemberOf(group);
   }
}

The new S.DS.AM makes it really easy to play around with users and groups in AD!