How to get all members of a local WinNT group?

Question

When I retrieve members of a local WinNT group, someway somehow not all members are returned. I do add:

• Active Directory users
• Active Directory groups

Both successful (see picture), but only the users show up afterwards.

Question is:

• What happens to added groups?
• See last method in code sample 'GetMembers()'
• Is this a known issue?
• Any workaround available?

Many thanks!!

string _domainName = @"MYDOMAIN";
string _basePath = @"WinNT://MYDOMAIN/myserver";
string _userName = @"MYDOMAIN\SvcAccount";
string _password = @"********";

void Main()
{
   CreateGroup("lg_TestGroup");
   AddMember("lg_TestGroup", @"m.y.username");
   AddMember("lg_TestGroup", @"Test_DomainGroup");

   GetMembers("lg_TestGroup");
}

// Method added for reference.
void CreateGroup(string accountName)
{
   using (DirectoryEntry rootEntry = new DirectoryEntry(_basePath, _userName, _password))
   {
      DirectoryEntry newEntry = rootEntry.Children.Add(accountName, "group");
        newEntry.CommitChanges();
   }
}

// Add Active Directory member to the local group.
void AddMember(string groupAccountName, string userName)
{
    string path = string.Format(@"{0}/{1}", _basePath, groupAccountName);
    using (DirectoryEntry entry = new DirectoryEntry(path, _userName, _password))
    {
        userName = string.Format("WinNT://{0}/{1}", _domainName, userName);
      entry.Invoke("Add", new object[] { userName });
        entry.CommitChanges();
    }
}

// Get all members of the local group.
void GetMembers(string groupAccountName)
{
    string path = string.Format(@"{0}/{1}", _basePath, groupAccountName);
   using (DirectoryEntry entry = new DirectoryEntry(path, _userName, _password))
   {
      foreach (object member in (IEnumerable) entry.Invoke("Members"))
      {
         using (DirectoryEntry memberEntry = new DirectoryEntry(member))
         {
            string accountName = memberEntry.Path.Replace(string.Format("WinNT://{0}/", _domainName), string.Format(@"{0}\", _domainName));
            Console.WriteLine("- " + accountName); // No groups displayed...
         }
      }
   }
}

Update #1 The sequence of the group members seems to be essential. As soon as the enumerator in GetMembers() stumbles on an Active Directory group, the remaining items are not displayed either. So if 'Test_DomainGroup' is listed first in this example, GetMembers() does not display anything at all.

Answer 1

I know it's an old question and you've likely found the answers you need, but just in case someone else stumbles accross this...

The WinNT ADSI provider you're using in your DirectoryEntry [ie. WinNT://MYDOMAIN/myserver] has pretty limited capabilities for working with Windows Domains that are not stuck in the old Windows 2000/NT functional level (https://support.microsoft.com/en-us/kb/322692).

In this case the problem is that the WinNT provider doesn't know how to handle Global or Universal security groups (which didn't exist in Windows NT and are activated as soon as you raise your domain level above Windows 2000 mixed mode). So, if any groups of those types are nested under a local group you'll generally have problems like the one you described.

The only solution/workaround I've found is to determine if the group you're enumerating is from a domain and if so, then switch to the LDAP provider which will display all members properly when invoking "Members".

Unfortunately I don't know of an "easy" way to just switch from using the WinNT provider to using the LDAP provider using the DirectoryEntry you already have bound to the WinNT provider. So, in the projects I've worked on, I generally prefer to get the SID of the current WinNT object and then use LDAP to search for domain objects with that same SID.

For Windows 2003+ domains you can convert your SID byte array to the usual SDDL format (S-1-5-21...) and then bind to an object with a matching SID using something like:

Byte[] SIDBytes = (Byte[])memberEntry.Properties["objectSID"].Value;
System.Security.Principal.SecurityIdentifier SID = new System.Security.Principal.SecurityIdentifier(SIDBytes, 0);

memberEntry.Dispose();
memberEntry = new DirectoryEntry("LDAP://" + _domainName + "/<SID=" + SID.ToString() + ">");

For Windows 2000 domains you can't bind directly to an object by SID. So, you have to convert your SID byte array to an array of the hex values with a "\" prefix (\01\06\05\16\EF\A2..) and then use the DirectorySearcher to find an object with a matching SID. A method to do this would look something like:

public DirectoryEntry FindMatchingSID(Byte[] SIDBytes, String Win2KDNSDomainName)
{
    using (DirectorySearcher Searcher = new DirectorySearcher("LDAP://" + Win2KDNSDomainName))
    {
        System.Text.StringBuilder SIDByteString = new System.Text.StringBuilder(SIDBytes.Length * 3);

        for (Int32 sidByteIndex = 0; sidByteIndex < SIDBytes.Length; sidByteIndex++)
            SIDByteString.AppendFormat("\\{0:x2}", SIDBytes[sidByteIndex]);

        Searcher.Filter = "(objectSid=" + SIDByteString.ToString() + ")";
        SearchResult result = Searcher.FindOne();

        if (result == null)
            throw new Exception("Unable to find an object using \"" + Searcher.Filter + "\".");
        else
            return result.GetDirectoryEntry();
    }
}