我正在尝试获取AD中的安全组列表,但我没有太多的运气。当我检查Active Directory用户和计算机MMC时,我看到:
blah.blah.com (top)
Group 1
Group1_1
Group1_2
Group1_2_1
Group2诸若此类。我需要的是Group1_2_1中的所有安全组我尝试使用DirectoryEntry和DirectorySearcher使用"(&(objectClass=group))“作为搜索筛选器,但我得到了一些我甚至在Active Directory用户和计算机MMC中都找不到的东西。
这是我在C#代码中的代码:
// Binding path.
string strPath = "LDAP://<domain_name>.ABC.DEF.COM";
// Binding object.
DirectoryEntry objADAM = default(DirectoryEntry);
// Group Results.
DirectoryEntry objGroupEntry = default(DirectoryEntry);
// Search object.
DirectorySearcher objSearchADAM = default(DirectorySearcher);
// Results collection.
SearchResultCollection objSearchResults = default(SearchResultCollection);
// Construct the binding string.
List<string> result = new List<string>();
// Get the AD LDS object.
try
{
objADAM = new DirectoryEntry(strPath);
objADAM.RefreshCache();
}
catch (Exception e)
{
throw e;
}
// Get search object, specify filter and scope,
// perform search.
try
{
objSearchADAM = new DirectorySearcher(objADAM);
objSearchADAM.Filter = "Group1_2_1 (groupType:1.2.840.113556.1.4.803:=2147483648)";
//objSearchADAM.Filter = "(&(objectCategory=group)(OU=Group1_2)(OU=Group1_2_1))";
objSearchADAM.SearchScope = SearchScope.Subtree;
objSearchResults = objSearchADAM.FindAll();
}谢谢。
发布于 2013-05-26 16:03:50
尝试:将基础设置为: Group1_2_1 (groupType:1.2.840.113556.1.4.803:=2147483648)
对于some more examples. -jim
发布于 2017-08-23 12:48:02
如果这仅适用于单个用户安全组,则下面是一个线性PowerShell脚本
Get-ADPrincipalGroupMembership -Identity >samaccount< | Where-Object {$_.distinguishedname -notcontains "config"}| Where-Object {$_.GroupCategory -notmatch "distribution"} | select name这将首先获得用户配置的完整成员资格,然后删除‘->’组->的成员资格,然后过滤掉通讯组->,最后它将只给您安全组的名称。
向您致敬,Avisekh
https://stackoverflow.com/questions/16738071
复制相似问题