Hi all,

I'm trying to use the "tokengroups" attribute of the user's security token to enumerate all group SIDs (which includes nested groups). I've referenced this forum article http://www.kixtart.org/forums/ubbthreads...true#Post130488 for syntax and this Microsoft support artice http://support.microsoft.com/kb/301916 for logic flow. The data is coming up blank.

If you are testing this $CurrentUser must be a valid user in your domain.
Any ideas or help would be greatly appreciated.

 Code:
$ADS_NAME_TYPE_NT4 = 3
$ADS_NAME_TYPE_1779 = 1

$CurrentUser = "AnyUserHere"
$NameTrans = CreateObject("nametranslate")
$NameTrans.set($ADS_NAME_TYPE_NT4, "YourDomain\" + $CurrentUser)
$DN = $NameTrans.get($ADS_NAME_TYPE_1779)
$oUser = GetObject("LDAP://" + $DN)
$arrTG = "tokengroups",""
$oUser.GetInfoEx($arrTG, 0)
$GroupList = $oUser.GetEx("tokengroups")
$oCvrt = CreateObject("ADs.ArrayConvert")

? "" + (ubound($GroupList)+1) + " entries returned"
?"Listing groups"?
For $i = 0 to ubound($GroupList)
	$hexSID = $oCvrt.CvOctetStr2vHexStr($Grouplist[$i])
	$oGroup = getObject("LDAP://<SID=" + $hexSID + ">")
	? $oGroup.Get("cn")
Next
?


Edited by Mart (2012-03-17 12:39 PM)
Edit Reason: Please use code tags when posting code.
_________________________
-- Tim

Lack of planning on your part,
does not make an emergency on my part.