List Groups a User is a Direct Member Of
Keywords: dsGetUsersGrps AD ADSI Active Directory Group Groups User Users Indirect Direct Member MemberOf
Question:
I use the ADSI Extender function dsGetUsersGrps to get all the groups from a specific user is a direct member of in AD but it gives me all groups, including groups the user is a indirect member of.
I want only the groups who you can get in the property of the user. I don't want the indirect groups.
Answer:
You can call dsGetProperty to query the memberOf property.
The memberOf property is a multi-valued property that contains groups of which the user is a direct member, depending on the domain controller (DC) from which this
property is retrieved:
- At a DC for the domain containing the user, memberOf for the user is complete with respect to membership for groups in that domain however, memberOf does not
contain the user's membership in domain local and global groups in other domains.
- At a GC server, memberOf for the user is complete with respect to all universal group memberships. If both conditions are true about the DC, both sets of
information are contained in memberOf.
Note that this property lists the groups that contain the user in their member property-it does not contain the recursive list of nested predecessors. For example,
if user O is a member of group C and group B and group B were nested in group A, the membersOf property of user O would list group C and group B but not group A.
This property is not stored - it is a computed back-link attribute.
Will not return the primary group. (Use 'dsGetPrimGrp')
lDirectGroups = dsGetProperty(strUser, "memberOf")
Article ID: W17531
Filename: List Groups a User is a Direct Member Of.txt
File Created: 2009:06:26:11:14:46
Last Updated: 2009:06:26:11:14:46