|
When testing Kix 4.51(also tried 4.52beta) i've discovered unexpected behaivour for InGroup()/EnumGroup(). The problem is i have Distribution (not security) groups in my W2k3 domain. Ingroup() returns false checking group membership for this groups, enumgroup() does not list them at all, moreover, group-membership cache is not reflecting this type of group membership. I've run comparable simple vb code to check group membership (see below) and got those groups listed, so I suppose there is a bug (or feature?))) in Kixtart? The side effect is if you later convert your distribution group to security one, you'll still get missing membership. If you create your group as security - no problem arrives, kixtart correctly reflects membership. Even afetr converting it to distribution and back. Converting security group to distribution raises the bug, converting back - eliminates bug. I suppose there is an AD attribute of this type of group being incorrectly filtered out. But better to have a bitmapped flag in InGroup()/EnumGroup() functions to be able to filter out distribution group membership.
Sample vb code (it works perfect -- but not kixtart):
On Error Resume Next
Const E_ADS_PROPERTY_NOT_FOUND = &h8000500D
Set objOU = GetObject("LDAP://cn=Users,dc=test,dc=com")
ObjOU.Filter= Array("user")
For Each objUser in objOU
WScript.Echo objUser.cn & " is a member of: "
WScript.Echo vbTab & "Primary Group ID: " & objUser.Get("primaryGroupID")
arrMemberOf = objUser.GetEx("memberOf")
If Err.Number <> E_ADS_PROPERTY_NOT_FOUND Then
For Each Group in arrMemberOf
WScript.Echo vbTab & Group
Next
Else
WScript.Echo vbTab & "memberOf attribute is not set"
Err.Clear
End If
Wscript.Echo
Next
Edited by Dmitry_F (2006-01-01 07:48 PM)
| 
