What permissions are required for enumerating users groups in Active Directory

Question

I have a .net web application which needs to obtain the groups a user is a member of in Active Directory.

Todo this I am using the memberOf attribute on the users records.

I need to know the permissions required to read this attribute on all users records.

Currently I am getting inconsistent results when trying to read this attribute. For example I have a user group of 30 users in the same OU path. Using my own credentials to query AD - I can read the memberOf attribute for some users but not others. I know all the users have a memberOf attribute set as I have checked when logged on with a domain admin account.

Should be on SF -- the API shouldn't matter, but the ACL on the AD object will. — Richard

Adam Jenkin Adam Jenkin · Accepted Answer · 2010-08-06T09:59:47

solved by sysadmin1138 here - https://serverfault.com/questions/167371/what-permissions-are-required-for-enumerating-users-groups-in-active-directory

What permissions are required for enumerating users groups in Active Directory

1 Answers