Fetch all groups (Global, Universal, Domain-Local) for a given user

Question

I am struggling to fetch all groups for a given user (domain1/user1)... The below C program (ran on a machine in domain1) works fine but it doesn't show the groups from other domain.. User1 is also part of domain2 but the below code doesn't show that information.. I breaking my head to figure out the other options but no luck.. Could you guys provide any suggestions...

void printGroups()
{
IADsUser *pUser;
IADsMembers *pGroups;
HRESULT hr = CoInitialize(NULL);
if (FAILED(hr)) return -1;
IID iid = IID_IADsUser;
hr = ADsGetObject(L"WinNT://domain1/user1", &iid, (void**)&pUser);

if (FAILED(hr)) {
printf("blad");
return -1;
}

pUser->lpVtbl->Groups(pUser, &pGroups);
//pUser->Groups(&pGroups);
pUser->lpVtbl->Release(pUser);
//pUser->Release();
if (FAILED(hr)) return -1;

IUnknown *pUnk;
hr = pGroups->lpVtbl->get__NewEnum(pGroups, &pUnk);
if (FAILED(hr)) return -1;
pGroups->lpVtbl->Release(pGroups);

IEnumVARIANT *pEnum;
iid = IID_IEnumVARIANT;
hr = pUnk->lpVtbl->QueryInterface(pUnk, &iid, (void**)&pEnum);
if (FAILED(hr)) return -1;

pUnk->lpVtbl->Release(pUnk);

// Enumerate.
BSTR bstr;
VARIANT var;
IADs *pADs;
ULONG lFetch;
IDispatch *pDisp;

VariantInit(&var);
hr = pEnum->lpVtbl->Next(pEnum, 1, &var, &lFetch);
while (hr == S_OK)
{
if (lFetch == 1)
{
pDisp = V_DISPATCH(&var);
iid = IID_IADs;
pDisp->lpVtbl->QueryInterface(pDisp, &iid, (void**)&pADs);
pADs->lpVtbl->get_Name(pADs, &bstr);
//printf("Group Name: %S\n", bstr);
pADs->lpVtbl->get_ADsPath(pADs, &bstr);
printf("Group ADPath: %S\n", bstr);
SysFreeString(bstr);
pADs->lpVtbl->Release(pADs);
}
VariantClear(&var);
pDisp = NULL;
hr = pEnum->lpVtbl->Next(pEnum, 1, &var, &lFetch);
};
hr = pEnum->lpVtbl->Release(pEnum);
return 0;

}

paulsm4 paulsm4 · Accepted Answer · 2017-08-17T03:41:50

I'd strongly urge you to consider something else besides that ancient COM/ActiveX API. For example, here's a PowerShell script that queries for a list of users:

import-module activedirectory
echo ""
echo "User Memberships:"
try {
  $users = @(
    "John", 
    "Paul", 
    "George", 
    "Ringo")
  foreach ($u in $users) {
    echo "USER: $u"
    Get-ADUser  -Identity $u -Properties MemberOf
  }
}
catch {
  $errmsg = "ERROR:Get-ADGroupMember(" + $g + "): " + $error
  $errmsg
  $error.Clear()
}

The other issue: I'm not sure how easy it is to do cross-domain queries - in any language, with any API.

For this example, I'd copy the script to a separate PC on the other domain, run it in both places, and just merge the results with notepad.

ADDENDUM:

You might also find this link helpful:

Search Active Directory for User and Office Locations

Fetch all groups (Global, Universal, Domain-Local) for a given user

1 Answers