Re: How to add a user to a group and programatically see that in its token

Do you need a real kernel mode token or do you just need to verify the group
membership? If the former, you could potentially use S4U to create a kernel
mode token for the user based only on their username. That requires AD 2003
and server 2003 and only works with domain accounts.

If you could deal with a "user mode" token, would
AuthzInitializeContextFromSid work for you?

Joe K.
--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"Garfield Lewis" <galewis@xxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:Oz49eMNaIHA.4712@xxxxxxxxxxxxxxxxxxxxxxx
Hi Kellie,

Thx, for the response but I guess I just wasn't too clear to begin with.
What I want to do is add a user to a group (which I already know how to
do) then without using LogonUser to get a brand new token (since I likely
will not have the users password). I was wondering if there was anyway for
me to get a token for that user that would show that it has been added to
the new group? I had thought ImpersonateSelf would do this but when I
inspect the token returned it doesn't have the new group listed.

--
Garfield A. Lewis


"Kellie Fitton" <KELLIEFITTON@xxxxxxxxx> wrote in message
news:c6f05f63-1951-4e91-8dc0-1c3f79b96ef7@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
On Feb 5, 10:59 am, "Garfield Lewis" <gale...@xxxxxxxxxxxxxxxxxxxxxx>
wrote:
Hi,

I want to be able to create a group, add a user to that group then
(without
using LogonUser) get a token for that user that lists the user as a
member
of that new group. Is this possible? This all has to be done in one shot
inside of my program.

Thx,

--
Garfield A. Lewis


Hi,

You can use the following APIs to add a user account and assigns
a password and privilege level:

NetUserAdd()

NetUserSetInfo()

NetGroupAddUser()

NetGroupSetUsers()

NetLocalGroupAddMembers()

http://msdn2.microsoft.com/en-us/library/aa370649(VS.85).aspx

http://msdn2.microsoft.com/en-us/library/aa370659(VS.85).aspx

http://msdn2.microsoft.com/en-us/library/aa370425(VS.85).aspx

http://msdn2.microsoft.com/en-us/library/aa370432(VS.85).aspx

http://msdn2.microsoft.com/en-us/library/aa370436(VS.85).aspx

Kellie.




.

Relevant Pages

  • Re: ActiveDirectoryMembershipProvider & ValidateUser
    ... membership provider to authenticate with AD? ... Joe Kaplan-MS MVP Directory Services Programming ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: General questions about LDAP, GC and access permissions
    ... Yes, that is the fully nested membership too, so you don't need to do any ... LDAP queries to discover the nesting. ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... calculate a user's group membership in the user's logon token. ...
    (microsoft.public.windows.server.active_directory)
  • Re: AD Group Memberships (MyADMembershipProvider) Question
    ... provider that integrates with the ASP.NET 2.0 role provider framework. ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... I am using MyADMembershipProvider as my membership provider to ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: ADAM Group Size
    ... Note that if the group membership exceeds 1500 users, code that enumerates ... Joe Kaplan-MS MVP Directory Services Programming ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... If group is using linked attribute as a place to store membership - I ...
    (microsoft.public.windows.server.active_directory)
Quantcast