WMI - query AD group membership

[Charlie Root]

Hi all,

is it possible to use Win32 classes to retrieve domain group membership
for the client? I guess it's not as i can't find any suitable classes in
the reference.

Please not that using other providers such as ADSI doesn't solve my
problem - I'm strictly limited to Win32....

Cheers,

Rad

[Gerry Hickman]

Hi,

I'm not sure what you mean. What does "domain group membership for the
client" mean? Do you mean group membership of the user who is logged
into box x or what?

Are you on an Active Directory domain or not?

If you're on AD, you should be able to use ADSI, if you're not, the
title of this message doesn't make much sense to me because it says "AD".

Post by Charlie Root
Hi all,
is it possible to use Win32 classes to retrieve domain group membership
for the client? I guess it's not as i can't find any suitable classes in
the reference.
Please not that using other providers such as ADSI doesn't solve my
problem - I'm strictly limited to Win32....
Cheers,
Rad

[Charlie Root]

Hi Gerry,

thanks for having look at this and sorry about being bit ambiguous in my
original post.

- both the machine and user are on a domain
- I need to retreive a list of domain groups the _machine_ is a member of
- I can't use ADSI, only Win32 WMI classes are available

Cheers,

Rad

Post by Gerry Hickman
Hi,
I'm not sure what you mean. What does "domain group membership for the
client" mean? Do you mean group membership of the user who is logged
into box x or what?
Are you on an Active Directory domain or not?
If you're on AD, you should be able to use ADSI, if you're not, the
title of this message doesn't make much sense to me because it says "AD".

Post by Charlie Root
Hi all,
is it possible to use Win32 classes to retrieve domain group
membership for the client? I guess it's not as i can't find any
suitable classes in the reference.
Please not that using other providers such as ADSI doesn't solve my
problem - I'm strictly limited to Win32....
Cheers,
Rad

[James Crosswell]

Post by Charlie Root
- I can't use ADSI, only Win32 WMI classes are available

What kind of programming language are you using?

You REALLY should use ADSI for this - WMI sucks at Active Directory
stuff (I've had info that took over an hour to fetch using WMI that was
obtained in around 6 seconds via ADSI). Seriously, use the tool for the
job and if your current programming language doesn't let you get at ADSI
then I'd recommend you use another one.

[Charlie Root]

Thanks James,

trouble is the WMI query expression needs to go into a framework product
which then executes it on a remote client. The framework intermediate
lanaguage only allows the use of Win32 classes. If I was given the
choice I would've used ADSI and never posted here!!! :D

So that's back to square one - any ideas if there's a way how to get
this information using WMI. It would also work if I was able to parse
from some other place (registry or config file) but afaik there isn't
place like this anywhere on the machine.

Rad

Post by James Crosswell

Post by Charlie Root
- I can't use ADSI, only Win32 WMI classes are available

What kind of programming language are you using?
You REALLY should use ADSI for this - WMI sucks at Active Directory
stuff (I've had info that took over an hour to fetch using WMI that was
obtained in around 6 seconds via ADSI). Seriously, use the tool for the
job and if your current programming language doesn't let you get at ADSI
then I'd recommend you use another one.

[Gerry Hickman]

Post by Charlie Root
trouble is the WMI query expression needs to go into a framework product
which then executes it on a remote client. The framework intermediate
lanaguage only allows the use of Win32 classes. If I was given the
choice I would've used ADSI and never posted here!!! :D

Hmm, maybe this "framework" needs re-designed?

It's worth looking at the "Active Directory Provider" for WMI. I've
never really understood what it's for, but it seems way over the top for
what you're asking. I think it's for people who actually want to monitor
and interact with the directory itself, not for simple look-ups.

There's also something called the "ADSI Extension" for WMI, but note
that this has been discontinued on Win2003 onwards.

I'm not entirely sure what you mean by "Win32 class", that could mean
almost any class from nearly any programming language compiled for
Win32. If you mean your framework only works with classes from WMI
beginning with "Win32" then that's crazy! What if you want to work with
CIM_DataFile??

Post by Charlie Root
So that's back to square one - any ideas if there's a way how to get
this information using WMI. It would also work if I was able to parse
from some other place (registry or config file) but afaik there isn't
place like this anywhere on the machine.

Bear in mind the whole point of Active Directory is that it's a SERVER
based look up. You are doing a lookup and asking "what security groups
does this computer belong to?" If this kind of info was in the registry
it would seem wrong to me (although we all know about ADSI caching on
the local machine but that's another story).

I can understand why you'd want to do this with users, but I don't know
why you'd want to do it with computers unless it's a complex setup with
special security groups for sets of computers. On my own network we do
most of this with Organizational Units (OUs) and as far as I know all
our computers are in the default security group, although I've never
needed to know.