Windows / Active Directory - User / Groups

Question

I'm looking for a way to find a the windows login associated with a specific group. I'm trying to add permissions to a tool that only allows names formatted like:

DOMAIN\USER 
DOMAIN\GROUP

I have a list of users in active directory format that I need to add:

ou=group1;ou=group2;ou=group3

I have tried adding DOMAIN\Group1, but I get a 'user not found' error.

P.S. should also be noted that I'm not a Lan admin

Answer 1

Install the "Windows Support Tools" that is on the Windows Server CD (CD 1 if it's Windows 2003 R2). If your CD/DVD drive is D: then it will be in D:\Support\Tools\SuppTools.msi

This gives you a couple of additional tools to "get at" AD: LDP.EXE - good for reading information in AD, but the UI kinda stinks. ADSI Edit - another snap-in for MMC.EXE that you can both browse AD with and get to all those pesky AD attributes you're looking for.

You can install these tools on your local workstation and access AD from there without domain admin privileges. If you can log on to the domain, you can at least query/read AD for this information.

Answer 2

You do not need domain admin rights to look at the active directory. By default, any (authenticated?) user can read the information that you need from the directory.

If that wasn't the case, for example, a computer (which has an associated account as well) could not verify the account and password of its user.

You only need admin rights to change the contents of the directory.

I think it is possible to set more restricted permissions, but that's not likely the case.

Answer 3

OU is an Organizational Unit (sort of like a Subfolder in Explorer), not a Group, Hence group1, 2 and 3 are not actually groups.

You are looking for the DN Attribute, also called "distinguishedName". You can simply use DOMAIN\DN once you have that.

Edit: For groups, the CN (Common Name) could also work.

The full string from Active Directory normally looks like this:

cn=Username,cn=Users,dc=DomainName,dc=com

(Can be longer or shorter, but the important bit is that the "ou" part is worthless for what you're trying to achieve.

Answer 4

Well, AdExplorer runs on your Local Workstation (which is why I prefer it) and I believe that most users have read access to AD anyway because that's actually required for stuff to work, but I'm not sure about that.

Answer 5

Programatically or Manually?

Manually, i prefer AdExplorer, which is a nice Active directory Browser. You just connect to your domain controller and then you can look for the user and see all the details. Of course, you need permissions on the Domain Controller, not sure which though.

Programatically, it depends on your language of couse. On .net, the System.DirectoryServices Namespace is your friend. (I don't have any code examples here unfortunately)

For Active Directory, I'm not really an expert apart from how to query it, but here are two links I found useful:

http://www.computerperformance.co.uk/Logon/LDAP_attributes_active_directory.htm

http://en.wikipedia.org/wiki/Active_Directory (General stuff about the Structure of AD)

Answer 6

Thanks adeel825 & Michael Stum.

My problem is, though, i'm in a big corporation and do not have access to log in as the domain admin nor to view the active directory, so i guess my solution is to try and get that level of access.