How to get AD user's 'memberof' property value in terms of objectGUID?

吃可爱长大的小学妹 提交于 2019-12-06 07:54:48

You can make use of the "Extended DN" LDAP extended control. It can be used only in AD search.

C# code:

// Here I get the user object and then do a AD search.
// Instead, you may search for that user object directly.
DirectoryEntry userEntry = new DirectoryEntry("LDAP://<server>/<user DN>", "user", "pwd");

DirectorySearcher searcher = new DirectorySearcher(userEntry);
searcher.SearchScope = SearchScope.Base;
searcher.ExtendedDN = ExtendedDN.Standard;
searcher.PropertiesToLoad.Clear();
searcher.PropertiesToLoad.Add("memberOf");

SearchResult result = searcher.FindOne();

foreach (string val in result.Properties["memberOf"])
{
    Console.WriteLine(val);
}

Depending on the value passed to ExtendedDN, it will return the value

<GUID=guid_value>;<SID=sid_value>;dn
  • ExtendedDN.None (only DN, this is the default):
    CN=Administrator, CN=Users,DC=Fabrikam,DC=com

  • ExtendedDN.Standard (Standard string format):
    <GUID=bdbfd4b3-453c-42ee-98e2-7b4a698a61b8>;<SID=S-1-5-21-2354834273-1534127952-2340477679-500>;CN=Administrator, CN=Users,DC=Fabrikam,DC=com

  • ExtendedDN.HexString (Hexadecimal format):
    <GUID=b3d4bfbd3c45ee4298e27b4a698a61b8>;<SID=01050000000000051500000061eb5b8c50ef705befda808bf4010000>;CN=Administrator, CN=Users,DC=Fabrikam,DC=com

If the object don't have SID, the SID part will be omitted:

<GUID=guid_value>;dn

For details about Extended DN, please check:

http://msdn.microsoft.com/en-us/library/cc223349.aspx

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!