Re: Determine AD group membership

Yep that is exactly what I was talking about but in addition to the security/distribution groups in the 3 scopes, there are also AzMan groups (group types 16 (APP_BASIC) and 32 (APP_QUERY)) to keep in mind as well.

As JoeK mentioned, the issue with token bloat and PAC overflow are getting to be larger and larger issues in enterprise class companies as folks do more and more group nesting and consolidate more and more resources into smaller and smaller realms (domains).

I have seen a variety of web portal and collaboration apps that completely use non-Windows security enabled groups which are used to secure all manner of resources. A user could be hundreds or even thousands of those groups with no impact on normal Windows operations.

If you know that you only care about Windows Security groups with scope local to the workstation involved, then using the local user token is completely fine.


--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm



Joe Kaplan (MVP - ADSI) wrote:
AD supports a variety of different types of groups, including security and distribution and 3 different scopes (global, universal and domain local).

If you are only interested in the security groups that a user would have in their local logon token, then use the logon token and GetTokenInformation. What Joe was trying to suggest though is that the user may be in many more groups than that, as they could be in domain local groups from other domains and could be in all manner of distribution groups. In order to discover that stuff, you'd really need to use LDAP as the native Windows APIs essentially ignore them.

So, it depends on what your app requires. It sounds like you are totally willing to just use the groups in the user's token, so you definitely want to avoid LDAP in that case. In many apps that Joe R. encounters, the apps purposefully use non-security groups for the application's security model so as to avoid increasing the number of groups in a user's logon token (which can affect logon performance and cause serious problems if the number gets up in the 1000 range).

The important thing for you is to understand what it is that you really require so you can address that accordingly.

Joe R. may (and probably will) clarify my clarification. My response is based on conversations he and I have had about this very subject offline.

Joe K.

.

Relevant Pages

  • Re: Windows Security Roles
    ... Does Windows 2000 Server support this as well? ... there are issues with using AzMan for this. ... It is useful to allow nested groups, and have a heirarchy of users, user ... We think that we are able to shift to only be using AD Security groups, ...
    (microsoft.public.dotnet.security)
  • Re: Determine AD group membership
    ... Do not confuse this with the kerberos PAC, ... I pretty much agree with JoeK that if you alert the people using the software that these are the limitations (i.e. security groups within the scope of the user and the machine they are being used on) then you should be fine. ... If your app is one that will generate lots of groups and users could be in lots of groups either through nesting or directly and you are not using Windows Securityand Windows ACLs then you should not generally be using security enabled groups unless the company is otherwise using those groups for Windows Security. ...
    (microsoft.public.platformsdk.security)
  • Re: Group Domain Admins cannot be found
    ... Universal Security groups when it comes to the restriction. ... In Windows 2000 Mixed mode Universal ... Changing mode to Windows 2000 Native mode enables Universal groups for ... Wonder what happens when I introduce a couple of 2008 servers;) ...
    (microsoft.public.windows.server.active_directory)
  • Re: Group Domain Admins cannot be found
    ... Changing the Domain Functional level appears to have fixed my ... Universal Security groups when it comes to the restriction. ... In Windows 2000 Mixed mode Universal ... Changing mode to Windows 2000 Native mode enables Universal groups for ...
    (microsoft.public.windows.server.active_directory)
  • Re: distribution lists in w2k mixed mode
    ... The problem with moving to a Windows mixed mode environment is that the DLs ... In Windows 2000 and above only Security groups can be used for permissions. ... your logs indicating that you cannot upgrade the group to a security group. ...
    (microsoft.public.exchange2000.setup.installation)