Re: Determine if IdentityReference is a Security Group

Hi Jeff,
Just to make sure I'm understanding you correctly:
You need to tell whether a sid is a user account or group, correct?

If so, I had the same problem and there are two solutions (that I could
find).
Get the Win32Security.dll You can then easily determine the type of sid but,
you're using interop to do this.
My other solution, which I went with, is to return all user accounts from
the domain with an ldap query and then
check the account in question against this list.

The drawback is the first time the app is run, it takes about 10 seconds to
populate the list.
But in our case 10 to 15 seconds is trivial compared to the time it takes to
perform the task in question.

--
Dan


"Jeffrey Walton" <noloader@xxxxxxxxx> wrote in message
news:b22f5d3a-fae9-49e8-be84-c78af6b84873@xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Hi All,

I've been trudging through old posts, but can't seem to find an
answer. This is the 'Effective Permissions' problem. I've seen a lot
of 'You Can't" and "Do it Using PInvoke/Windows API". I'd like to stay
with a C# solution. Google is only returning two pages. The pages
returned are more of the question, "Is the user a member of a
group?" [1].

From the files system object (directory or file), I have a collection
of AuthorizationRules. I need place the rules (some hand waiving) into
bins to enforce Windows Security business logic (order of Allow/Deny
and User/Group matters):

DenyUser
DenyGroups
AllowUser
AllowGroups

Allow and Deny are easily obtained from IdentityReference. The Sid is
easily obtained also. However, given an IdentityReference (or SID),
how do I determine if it is a Security Group? In a nushell, I want:

IsSecurityGroup( IdentityReference id ) or
IsSecurityGroup( SecurityIdentifier sid )

WindowsIdentity Class does not offer the function [2]. Given a user,
WindowsIdentity will give me a list of the user's groups. But I do not
need this information.

Thanks,
Jeff
Jeffrey Walton

[1] http://groups.google.com/groups?hl=en&q=c%23+IdentityReference+group
[2]
http://msdn2.microsoft.com/en-us/library/system.security.principal.windowsidentity.aspx


.

Relevant Pages

  • Re: Determine if IdentityReference is a Security Group
    ... bins to enforce Windows Security business logic (order of Allow/Deny ... Allow and Deny are easily obtained from IdentityReference. ... However, given an IdentityReference (or SID), ... WindowsIdentity will give me a list of the user's groups. ...
    (microsoft.public.dotnet.security)
  • Determine if IdentityReference is a Security Group
    ... bins to enforce Windows Security business logic (order of Allow/Deny ... Allow and Deny are easily obtained from IdentityReference. ... However, given an IdentityReference (or SID), ... WindowsIdentity will give me a list of the user's groups. ...
    (microsoft.public.dotnet.security)
  • Re: NTFS File Encryption Question
    ... I am certainly no expert on EFS and the XP implementation, ... know it is tied to the SID of the user account in question. ... >>>What do I need to do to be able to access these files on my laptop? ...
    (microsoft.public.windowsxp.general)
  • Re: Write to the registry
    ... The whole point is to move all users from a local work group account to a ... > migrate a local user account to a new domain user account and keep ... > the same user SID. ... > torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway ...
    (microsoft.public.windows.server.scripting)
  • RE: sid
    ... resolve a fully qualified SID to a user account against a local or remote ... Sid2name.exe was recently built to resolve SID ... An optional command argument can specify on which Windows NT ... - When this line is typed at the command prompt ...
    (microsoft.public.win2000.security)
Loading