Re: Any chance to differ local group or domain group from windowsIdentity groups?

So you want to check if a user is domain admin - not local admin?

you can construct a SecurityIdentitifier using the WellknownSids enum - there you will find domain admins -

for the 2nd parameter - the issuer SID - use WindowsIdentity.User.AccountDomainSid

HTH

-----
Dominick Baier (http://www.leastprivilege.com)

Developing More Secure Microsoft ASP.NET 2.0 Applications (http://www.microsoft.com/mspress/books/9989.asp)

Hi,

When a user belongs to local admin, but not domain admin group, can I
still use windowsidentity.groups or windowsprincipal.isinrole?

The thing is that I need to make sure that the user belongs to domain
admin group(the builtin administrators group in a domain). If I use
windowsIdentity class, a user belonging to a local admin( a builtin
administrators group on the machine) will return true.
I think the reason is that builtin administrators group on a computer
or on a machine has the same sid- S-1-5-32-544.
Is there a way to do it with windowsIdentity class? Or is it a way to
differ a local builtin computer group and builtin domain group?

Thanks

If I use windows principal and windowsIdentiy



.

Relevant Pages

  • Re: Local admin becomes domain admin - Dubmwabbit
    ... "There is nothing about having local admin access that makes it easier to ... suckering a stupid domain admin." ...
    (microsoft.public.win2000.security)
  • Re: STSadm createssp
    ... The strange thing is that when I log on using the Central Admin ... service account I succeed in creating the SSP, ... my WFE and my SQL box and is member of the farm administrators group. ... All you should need is local admin on the local box for the proper ...
    (microsoft.public.sharepoint.portalserver)
  • Re: Trouble migrating couputers (ADMT v3)
    ... Logging on as the domain admin works in some cases, but in my experience, ... you'll still not be able to move some of the computers as the domain admin, ... Once the proper account is in the administrators group, ...
    (microsoft.public.windows.server.general)
  • Re: Local admin becomes domain admin - Dubmwabbit
    ... You still haven't said anything on how to get domain admin with PC's local ... local admin access. ... There is nothing about having local admin access that ...
    (microsoft.public.win2000.security)
  • Re: Administrator account / Domian Addmin rights
    ... But then you speak of admin account ... almost as if it is not a domain admin account. ... local administrators group, then it is possible to remove the ...
    (microsoft.public.win2000.security)