Introduction
This is a very simple class that will search a given AD group and all groups beneath it and return all user accounts that are members of these groups.
This sounds really simple, and it is, but when I searched the Internet for a solution, I could not find one, so I thought I'd share it here.
Using the Code
There are basically three methods in this class, all are marked static
, so you don't have to instantiate the class to use the public
method.
Just call the method x(string strGroupName)
, pass in the name of the group (display name, not the DN), you get an ArrayList
containing the SAM Account Names of all users in this group or any sub-group. If your AD should contain several groups with the same name, which is a bad practice anyway, it will just use the first it finds.
x
will then call getUsersInGroup(string strGroupDN)
passing in the DN of the group you chose.
getUsersInGroup
will first collect all users that are members of this group, then walk though all groups in the given group and call itself recursively for each group.
In order to avoid endless loops when you have a circular group structure in AD, it keeps track of all "visited" groups in the global variable, searchedGroups
.
I think the code is pretty much self-explanatory, so I just pasted it in below.
using System;
using System.Collections;
using System.Text;
using System.DirectoryServices;
namespace ADgroupSearcher
{
class getGroupMembers
{
static Hashtable searchedGroups = null;
static public ArrayList x(string strGroupName)
{
ArrayList groupMembers = new ArrayList();
searchedGroups = new Hashtable();
DirectorySearcher search = new DirectorySearcher("LDAP://DC=company,DC=com");
search.Filter = String.Format
("(&(objectCategory=group)(cn={0}))", strGroupName);
search.PropertiesToLoad.Add("distinguishedName");
SearchResult sru = null;
DirectoryEntry group;
try
{
sru = search.FindOne();
}
catch (Exception ex)
{
throw ex;
}
group = sru.GetDirectoryEntry();
groupMembers = getUsersInGroup
(group.Properties["distinguishedName"].Value.ToString());
return groupMembers;
}
private static ArrayList getUsersInGroup(string strGroupDN)
{
ArrayList groupMembers = new ArrayList();
searchedGroups.Add(strGroupDN, strGroupDN);
DirectorySearcher ds = new DirectorySearcher("LDAP://DC=company,DC=com");
ds.Filter = String.Format
("(&(memberOf={0})(objectClass=person))", strGroupDN);
ds.PropertiesToLoad.Add("distinguishedName");
ds.PropertiesToLoad.Add("givenname");
ds.PropertiesToLoad.Add("samaccountname");
ds.PropertiesToLoad.Add("sn");
foreach (SearchResult sr in ds.FindAll())
{
groupMembers.Add(sr.Properties["samaccountname"][0].ToString());
}
ArrayList al = getNestedGroups(strGroupDN);
foreach (object g in al)
{
if (!searchedGroups.ContainsKey(g))
{
ArrayList ml = getUsersInGroup(g as string);
foreach (object s in ml)
{
groupMembers.Add(s as string);
}
}
}
return groupMembers;
}
private static ArrayList getNestedGroups(string strGroupDN)
{
ArrayList groupMembers = new ArrayList();
DirectorySearcher ds = new DirectorySearcher("LDAP://DC=company,DC=com");
ds.Filter = String.Format
("(&(memberOf={0})(objectClass=group))", strGroupDN);
ds.PropertiesToLoad.Add("distinguishedName");
foreach (SearchResult sr in ds.FindAll())
{
groupMembers.Add(sr.Properties["distinguishedName"][0].ToString());
}
return groupMembers;
}
}
}
Final Remarks
This code is provided for your convenience. It certainly needs proper error handling added, and maybe there are better solutions? I will not change the code, as it does what I needed it to do. I used it for a one-time chore only. If you know better/faster solutions, I look forward to your comments.
History
- 26th June, 2008: Initial post