#150408 - 2005-10-22 12:00 AM
Doing an InGroup() on a different user?
|
sixdoubleo
Starting to like KiXtart
Registered: 2004-02-06
Posts: 118
Loc: California, US
|
What is the best way to perform an InGroup on a different user (not the one running the script)???
Something like...
If UserInGroup($UserID, $Group)
Do Something
EndIf
Currently I enumerate the groups from the user's object, but that only gives me groups that the user is immediately a member of...not groups that the user is a member of via nesting (the way InGroup() does.)
Edited by sixdoubleo (2005-10-22 12:09 AM)
|
|
Top
|
|
|
|
|
#150410 - 2005-10-22 01:05 AM
Re: Doing an InGroup() on a different user?
|
sixdoubleo
Starting to like KiXtart
Registered: 2004-02-06
Posts: 118
Loc: California, US
|
Quote:
You may want to query AD with one of the LDAP UDFs.
But what would I query? At best couldn't I just return a list of groups the user is a member of? Or is there a way to do that with an AD query? I think that's pretty much what I am doing now but like I said, I only get a list of groups that the user is immediately a member of.
|
|
Top
|
|
|
|
|
#150412 - 2005-10-22 02:22 AM
Re: Doing an InGroup() on a different user?
|
sixdoubleo
Starting to like KiXtart
Registered: 2004-02-06
Posts: 118
Loc: California, US
|
Quote:
If the INGROUP function only queries the groups the script initiator is a member of, then another method like querying AD for user membership, then using the results in an array may be a work around for your situation.
I'm not intimately familiar with the LDAP querying UDFs, so my recommendation was more of an impression of what may be a good direction for you to go, rather than an authoritative suggestion.
Right. Well, the nice thing about InGroup() is that it checks nested membership. So if I'm a member of "Division Admins" which is a member of "Department Admins", then If InGroup("Department Admins") would be true.
Dumping group names from AD would only give me the immediate groups that the user is a member of...I would then need to recursively check membership on those groups. If that's the way I need to go about this, then that's what I'll do...but I just wanted to see if somebody had already written something.
|
|
Top
|
|
|
|
|
#150413 - 2005-10-22 02:32 AM
Re: Doing an InGroup() on a different user?
|
StarwarsKid
Seasoned Scripter
Registered: 2005-06-15
Posts: 506
Loc: Oregon, USA
|
|
|
Top
|
|
|
|
#150414 - 2005-10-26 05:34 PM
Re: Doing an InGroup() on a different user?
|
sixdoubleo
Starting to like KiXtart
Registered: 2004-02-06
Posts: 118
Loc: California, US
|
So any ideas guys??? Is my only option to dump the groups the user is a member and then recursively keep dumping membership?
|
|
Top
|
|
|
|
|
#150419 - 2005-10-26 11:34 PM
Re: Doing an InGroup() on a different user?
|
sixdoubleo
Starting to like KiXtart
Registered: 2004-02-06
Posts: 118
Loc: California, US
|
Quote:
See http://msdn.microsoft.com/library/default.asp?url=/library/en-us/adsi/adsi/iadsgroup.asp for a method to return the group memberships of an arbitrary user.
Thanks. But in looking at the documentation for "IsMember" it says:
bMember
[out] Pointer to a VARIANT_BOOL value that receives VARIANT_TRUE if the object is an immediate member of the group or VARIANT_FALSE otherwise.
My testing confirms this. It reports a true when the user is an immediate member. It reports a false when the user is a member via nesting.
Code:
$User = "jsmith"
$Group = "Support Staff"
$grp = GetObject("WinNT://SCONET/" + $Group)
? $User + " ---> " + $Group + " = " + $grp.IsMember("WinNT://SCONET/"+$User)
|
|
Top
|
|
|
|
Moderator: Arend_, Allen, Jochen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Mart
|
|
