Re: retrieving Group/OU membership for a user using ADSI/C++         


Author: Richard Mueller [MVP]
Date: May 22, 2008 07:40

"WebDrive" discussions.microsoft.com> wrote in message
news:6CDC3535-9CD8-4766-8C15-95B12EA8CCE1@microsoft.com...
> Hello,
> I'm trying to generate a list of groups/OU's to which a user belongs
> through ADSI and am having problems. My AD looks like
>
> DC=FOO,DC=COM
> ---OU=OrgUnit1
> -------CN=GlobalSecurityGroup1
> ------------------member=CN=User1,OU=OrgUnit1,DC=FOO,DC=COM
> ------------------member=CN=User2,OU=OrgUnit1,DC=FOO,DC=COM
> ------------------member=CN=User3,OU=OrgUnit1,DC=FOO,DC=COM
> -------CN=User1
> -------CN=User2
> -------CN=User3
> -------CN=BuiltIn
> -------CN=Users
>
> So I have a top level OU which contains 3 users, User1,User2 and User3.
> The
> OU also contains GlobalSecurityGroup1 which has three members, User1,User2
> and User3.
>
> How can I use ADSI to generate a list of OUs/Groups to which User2
> belongs?
> I'd like to get a result set of GlobalSecurityGroup1 and OrgUnit1?
>
> I'm able to search DC=FOO,DC=COM and specify the following filter
>
> member:1.2.840.113556.1.4.1941:=CN=User2,OU=OrgUnit1,DC=FOO,DC=COM
>
> which will return the NT Security Group, but not OrgUnit1, do I need two
> different queries?
>
>
> Thanks!
> Michael
>

The memberOf attribute of the user object is a collection of the DN's of the
groups the user is a direct member of (except the "primary" group). There
can be no DN's, one DN, or more than one DN in memberOf.

There is no attribute representing "OU membership". The object is not a
member of the OU (like the object can be the member of a group). The object
resides in the OU container. You can parse the Distinguished Name (DN) of
the user for the DN of the OU. Or, you can use the Parent method of the user
object to retrieve the Distinguished Name of the parent container/OU.

Note in your example that the parent will be "ou=OrgUnit1,dc=foo,dc=com".
The name of the OU will be "OrgUnit1", but this does not uniquely identify
the OU. There could be several OU's in the domain with the same Relative
Distinguished Name.

--
Richard Mueller
MVP Directory Services
Hilltop Lab - http://www.rlmueller.net
--
diggit! del.icio.us! reddit!