Missing group members in ADSI & LDAP

Hi there. I have an AD problem here (obviously :))
It started by wanting to list all members of a group (recursivly, but that does not matter for now, the problem occurs on a single group).
I tried this in Powershell, but our AD is still on 2003, so no AD web services, so no powershell.
In PHP & Java I got the same results: It only shows 3 members, where there should be 23.
In Active Directory Computers & Users, these 23 (including a group) are listed on the member tab.
In ADSI I see only the 3 entries mentioned above in the attribute "member", and the other users don't have the membersOf attribute backlink.
dsget group -members (-expand) works properly.
Where do Active Directory Computers & Users and dsget get their information regarding group members from, and how can I access that programmatically via LDAP access from php or Java?

Sorry, forgot about the Domain Users or the Domain Admins group over the link/image upload issue.
No, it wasn't these groups.
But: you were on the right path. The term primary group is what I was missing.
The group is for one of our roadwarrior subsidiaries, and they are not Domain users as primary group, but the one shown here.
Do you happen to know which LDAP attributes represent the primary group association?
The primaryGroupID attriute store the RID of the group that is assigned as the primary group. This was to work around the limitation in Windows 2000 before LVR (Linked-Value Replication) so that more than 5000 users could be member of the same group. (It also
plays a role for POSIX - Services for Mac clients)
Enfo Zipper
Christoffer Andersson – Principal Advisor
http://blogs.chrisse.se - Directory Services Blog

Similar Messages

LDAP group members

Hello
I connected my Workflow Server 7.2.2 (on Win 2003) to an active Directory. I am able to get the users and the groups but I am not able to get the group members.
Do you have any idea what could be the problem
Olivier

Hi
I found the solution.
When we first synchronize users and groups with the directory, some dc parameters were replaced with number ????
So users from the LDAP were no more matching users in our DB. We deleted users and groups in the DB (we made a vmware snapshot first) and we recreated the ldap connection. This time the synchronization went OK and we were able to get the group members.
Olivier

Ldap realm won't recognise group members...

I've modified the defaultLDAPRealmForNovellDirectoryServices to talk to
Novell e-directory v8.6.
The Weblogic console correctly displays my Ldap groups. I have custom ACL's
defined (in the filerealm, (Jerry - I'm also baffled how to do this in
Ldap)) with permissions granted to my Ldap groups of which my Ldap user is a
memeber. This user is authenticated (can logon) correctly but can't perform
actions that their group permissions permit. (Users defined in the file
realm with this permission have no problem).
I can only think that the Ldap group is not recognising its members. This
is, of course, impossible to test as listing members of a group has been
disabled in Ldap realm v2....
If anyone has encountered such a problem, or can see an obvious solution,
cheers, very grateful.
<CustomRealm
ConfigurationData="user.filter=(&(cn=%u)(objectclass=person));user.dn=ou
=people, dc=ftid,
dc=com;server.principal=cn=Admin,dc=ftid,dc=com;membership.filter=(&(uni
queMember=%M)(objectclass=groupOfNames));group.filter=(&(cn=%g)(objectcl
ass=groupOfNames));server.host=localhost
server.port=389;server.ssl=false;group.dn=ou=Groups, dc=ftid, dc=com"
Name="defaultLDAPRealmForNovellDirectoryServices"
Notes="No notes" Password="{3DES}q4+IymeHqO2H/zvRdQK5oA=="
RealmClassName="weblogic.security.ldaprealmv2.LDAPRealm"/>
Ldif export for my group.
dn: cn=LdapUpdaterPrincipal, ou=Groups, dc=ftid, dc=com
equivalentToMe: cn=tom,ou=people,dc=ftid,dc=com
objectClass: groupOfNames
objectClass: top
uniqueMember: cn=tom,ou=people,dc=ftid,dc=com
uniqueMember: cn=andy,ou=people,dc=ftid,dc=com
ACL: 2#entry#[Root]#uniqueMember
cn: LdapUpdaterPrincipal
I'm using wl6.1 sp2.
Cheers,
Alan.

solved, sorry, it was a problem with the principal-name in the
weblogic-ejb-jar file not mapping to the correct group name...
Alan
"Alan Phillips" <alan.phillips@|remove|ftid.com> wrote in message
news:3c690985$[email protected]..
I've modified the defaultLDAPRealmForNovellDirectoryServices to talk to
Novell e-directory v8.6.
The Weblogic console correctly displays my Ldap groups. I have customACL's
defined (in the filerealm, (Jerry - I'm also baffled how to do this in
Ldap)) with permissions granted to my Ldap groups of which my Ldap user isa
memeber. This user is authenticated (can logon) correctly but can'tperform
actions that their group permissions permit. (Users defined in the file
realm with this permission have no problem).
I can only think that the Ldap group is not recognising its members. This
is, of course, impossible to test as listing members of a group has been
disabled in Ldap realm v2....
If anyone has encountered such a problem, or can see an obvious solution,
cheers, very grateful.
<CustomRealm
ConfigurationData="user.filter=(&(cn=%u)(objectclass=person));user.dn=ou
=people, dc=ftid,
dc=com;server.principal=cn=Admin,dc=ftid,dc=com;membership.filter=(&(uni
>
queMember=%M)(objectclass=groupOfNames));group.filter=(&(cn=%g)(objectcl
ass=groupOfNames));server.host=localhost
server.port=389;server.ssl=false;group.dn=ou=Groups, dc=ftid, dc=com"
Name="defaultLDAPRealmForNovellDirectoryServices"
Notes="No notes" Password="{3DES}q4+IymeHqO2H/zvRdQK5oA=="
RealmClassName="weblogic.security.ldaprealmv2.LDAPRealm"/>
Ldif export for my group.
dn: cn=LdapUpdaterPrincipal, ou=Groups, dc=ftid, dc=com
equivalentToMe: cn=tom,ou=people,dc=ftid,dc=com
objectClass: groupOfNames
objectClass: top
uniqueMember: cn=tom,ou=people,dc=ftid,dc=com
uniqueMember: cn=andy,ou=people,dc=ftid,dc=com
ACL: 2#entry#[Root]#uniqueMember
cn: LdapUpdaterPrincipal
I'm using wl6.1 sp2.
Cheers,
Alan.

How to bulk add group members in Open Directory

So the workgroup manager interface is ghey. The + sign to add group members drag&drops users one at a time. I need to bulk add group members.
I tried ldapadd to add all the users quickly and that doesn't seem to work. The ldap group record now has all the users populated, under the multivalued attribute memberUid), but workgroup manager doesn't see the bulk group members.
Any idea how to do this?

Use tcsh SHELL builtin command 'foreach' to accomplish this:
$ tcsh
$ which foreach
foreach: shell built-in command.
$ foreach user (`cat users.txt`)
foreach? echo adding $user to group
foreach? /usr/bin/dscl -u diradmin -P [passwd] /LDAPv3/127.0.0.1 append /Groups/yourgroup GroupMembership $user
foreach? end

SharePoint Hosted App to Read members of Site owner group, if "Who can view the membership of the group? " is set to Group members only

Hi,
Is there a way to read group members of site owner group via SharePoint hosted app . The "Who can view the membership of the group? " is set to Group members only. As per my research SCA can only view the group members of site owner group
if this settings is applied.
Thanks,
Sudhir
Sudhir rawat

See this.
Avoid changing the MaxPageSize LDAP query policy
http://jeftek.com/219/avoid-changing-the-maxpagesize-ldap-query-policy/
Regards~Biswajit
Disclaimer: This posting is provided & with no warranties or guarantees and confers no rights.
MCP 2003,MCSA 2003, MCSA:M 2003, CCNA, MCTS, Enterprise Admin
MY BLOG
Domain Controllers inventory-Quest Powershell
Generate Report for Bulk Servers-LastBootUpTime,SerialNumber,InstallDate
Generate a Report for installed Hotfix for Bulk Servers

CustomRealm without listing Group Members

Hi,
we are considering to implement a custom security realm. We have a fixed number
of groups to be used in ACLs. Users are stored in an LDAP server.
Group membership depends on some information on the individual user which needs
to be gathered from a separate backend system. Therefore, it is not feasible to
implement the getMembers() method on the Group class since that means iterating
over all "user records" in the backend system.
Here my question:
1. Is the getMembers() method needed for Authorization and/or Authentication or
can we simply make it return an empty list? (We do not mind if we do not see group
members in the administration console.)
2. Is it a good idea at all to have this kind of group definition?
3. What about the method "getUsers" for the ListableRealm? Is this one needed
for Authorization/Authentification. This method poses a similar problem.
Regards,
Andreas

1. Is the getMembers() method needed for Authorization and/orAuthentication or
can we simply make it return an empty list? (We do not mind if we do notsee group
members in the administration console.)I think this method is not needed at all for authentication and
authorization, it's only used to list the users in the WL admin page.
3. What about the method "getUsers" for the ListableRealm? Is this oneneeded
for Authorization/Authentification. This method poses a similar problem.Same answer.

LDAPRealmV2 using group members as entries

Hi all,
we have configured our ldaprealm v2 (wls 6.1) to have group members as entries
below the group as opposed to the normal setup with group members as attributes
of one group. This has imposed some strange problems. We have several groups mapped
to one role in our webapps, but only members of some of the groups get access.
From the debug output of the realm I see that the groups working have a dn like:
groupName=GROUPA, ou=Groups, dc=common, dc=company,dc=com
and the ones that don't have a dn like:
groupName=GROUPB,ou=Groups,dc=common,dc=company,dc=com
that is the only differences are the spaces. I don't see how this could make such
a difference. In the LDAP all the groups look exactly the same.
Does anyone have any experience with this or have seen similar problems
Our ldap realm is configured like this:
server.host=someserver;
server.principal=cn=Manager,dc=company,dc=com;
user.filter=(&(uid=%u)(objectclass=person));
user.dn=ou=People, dc=common, dc=company, dc=com;
membership.scope=sub;
membership.scope.depth=1;
membership.filter=(&(member=%M)(objectclass=groupMember));
group.filter=(&(groupName=%g)(objectclass=Group));
group.dn=ou=Groups, dc=common, dc=company,dc=com

Check your attribute precedence in the metaverse for the group objects "member" attribute. Make sure your ADMA is set to the highest precedence.
Also ensure that the attribute flow on your FIM MA is an export and not an import.

List Local Group members with PowerShell 5

This script:
$Server="."
$LocalGroup = "Administrators"
$Group= [ADSI]"WinNT://$Server/$LocalGroup,group"
$Members = @($Group.psbase.Invoke("Members"))
$Members | ForEach-Object {
$_.GetType().InvokeMember("Name", 'GetProperty', $null, $_, $null)
works fine in powershell 2 (windows 7), but fails on powershell 5
"Error while invoking GetType. Could not find member."
It returns only domain groups. No local groups or local users or domain users.
Is there a reason why? And can it be modified for powershell 5?
Thanks

Try it like this:
$group=[ADSI]"WinNT://$env:COMPUTERNAME/Administrators,group"
$group.Members() |
ForEach-Object {
($_.GetType()).InvokeMember('Name', 'GetProperty', $null, $_, $null)
¯\_(ツ)_/¯

OD Group members not synchronized to mailing lists

We have some Groups in the SLS OD that we configured as wikis to distribute Dokuments to the members. Last year the configuration of the wiki vanished from the workgroup manager and I think since then the members of the groups were no longer synced with the mailing lists.
This is what I tried:
I looked after /etc/aliases and found it was an old version (it misses new members and has old ones).
So I looked where it was built from and found /Library/Application Support/Apple/mailinglists/mailinglists.plist. If I delete this file it is rebuild but with the old accounts.
So I think there is missing a actual synchronisation between the OD and the mailinglists.plist file. But how it is done?

Hi ,
SharePoint 2010 permission group cannot have email address but AD Security Group can.
If you want to make your AD Group and members address are created, you may want to use the PowerShell like Set-mailbox “MailboxAddress” -EmailAddressPolicyEnabled $true to enable "Automatically update e-mail addresses based on e-mail address
policy", here are two articles about this.
http://johnyassa.wordpress.com/2012/07/17/disable-automatically-update-e-mail-addresses-based-on-email-address-policy/
http://technet.microsoft.com/en-us/library/bb123981.aspx
And for more questions about the AD user and Exchange mail address, you can post in Exchange server forum and be able to get a better assistance there,
http://social.technet.microsoft.com/Forums/en-US/exchange2010/threads
Thanks
Daniel Yang
TechNet Community Support

Convergence group members for invitations

Dear all,
we use Convergence with latest patch level. For invitations of groups and using check availability the group members are not resolved and therefore the busy/free time of group members is not displayed. Instead the group name is displayed but the group itself have not calendar.
Is there any possibility - maybe in the config of convergence of ldap settings groups - that the individual calendars of the invited group members with showing free/busy time show up and in consequence the auto select time will work, too.
The invitation of the group members itself works fine.
Thanks for any help

How are the group members defined in the LDAP entry for the group?
With the assumption that you are using Calendar 7 with Convergence, the Calendar configuration considers the following attributes for members in an LDAP group:
<tt>
davcore.ldapattr.dngroupmember=uniquemember
davcore.ldapattr.urlgroupmember=memberurl
davcore.ldapattr.mailgroupmember=mgrprfc822mailmember
</tt>
Only <tt>uniqueMember</tt> is considered for ACL checking, along with invitation and free/busy scheduling.
The <tt>mgrprfc822mailmember</tt> attribute is taken into account only when inviting the group.
This is because, when doing the ACL check, we are relying on the LDAP Directory to provide us with the <tt>isMemberOf</tt> attribute directly on the logged in user LDAP entry (as opposed to looking at all the members of the group). The <tt>isMemberOf</tt> operational attribute is itself derived from the <tt>uniqueMember</tt> attribute only.
Doing a group expansion for ACL purposes would be too expensive an operation.
As a side note, we also check for dynamic group membership through the <tt>memberurl</tt> LDAP attribute of the group, both for scheduling and ACL purposes.
Reference KM Doc:
Calendar 7: Allowing Members Of A Migrated LDAP Group To Subscribe To Calendars (Doc ID 1483916.1)
-Deb

6.1 SP2 Caching realm not caching group members

Hello:
We have caching realm set over LDAP security realm.
We see caching realm never caching group members.
Any help is appreciated.
Thanks
Gennadiy
Here is the sequence we see:
1) Search for user name - OK
2) Search for group name - OK
3) - ALWAYS going to LDAP to get group members even though they should be cached
at this point.
The question is - why does it go to LDAP at all?
I am doing the same call a 1-2 seconds apart. The group members should be cached.
It looks like caching realm does not actually cache the members within a group.
The realm is configured to cache group membership:
Enable Group Cache true
Group Cache Size: 211
Group Cache TTLPositive: 600
Group Cache TTLNegative: 600
Group Membership Cache TTL: 300
<Jul 17, 2002 8:53:49 AM EDT> <Debug> <CachingRealm> <getUser("AppLayerRunAs")>
<Jul 17, 2002 8:53:49 AM EDT> <Debug> <CachingRealm> <user: pos HIT AppLayerRunAs>
<Jul 17, 2002 8:53:49 AM EDT> <Debug> <CachingRealm> <getAcl("weblogic.jndi.CCSAcctEntityBean",
'.')>
<Jul 17, 2002 8:53:49 AM EDT> <Debug> <CachingRealm> <getAcl("weblogic.jndi.CCSAcctEntityBean")>
<Jul 17, 2002 8:53:49 AM EDT> <Debug> <CachingRealm> <acl: neg HIT weblogic.jndi.CCSAcctEntityBean>
<Jul 17, 2002 8:53:49 AM EDT> <Debug> <CachingRealm> <getAcl("weblogic.jndi")>
<Jul 17, 2002 8:53:49 AM EDT> <Debug> <CachingRealm> <acl: neg HIT weblogic.jndi>
<Jul 17, 2002 8:53:49 AM EDT> <Debug> <CachingRealm> <getAcl("weblogic")>
<Jul 17, 2002 8:53:49 AM EDT> <Debug> <CachingRealm> <acl: neg HIT weblogic>
<Jul 17, 2002 8:53:49 AM EDT> <Debug> <CachingRealm> <getUser("AppLayerRunAs")>
<Jul 17, 2002 8:53:49 AM EDT> <Debug> <CachingRealm> <user: pos HIT AppLayerRunAs>
<Jul 17, 2002 8:53:49 AM EDT> <Debug> <CachingRealm> <getUser("AcctEntityUsers")>
<Jul 17, 2002 8:53:49 AM EDT> <Debug> <CachingRealm> <user: neg HIT AcctEntityUsers>
<Jul 17, 2002 8:53:49 AM EDT> <Debug> <CachingRealm> <getGroup("AcctEntityUsers")>
<Jul 17, 2002 8:53:49 AM EDT> <Debug> <CachingRealm> <group: pos HIT AcctEntityUsers>
<Jul 17, 2002 8:53:49 AM EDT> <Debug> <LDAPRealm> <search("ou=ldap, ou=dev_serv,
ou=hick, o=ccs", "(&(member=cn=AppLayerRunAs,ou=LDAP
ICK,o=CCS)(objectclass=groupofuniquenames))", base DN & below)>
<Jul 17, 2002 8:53:49 AM EDT> <Debug> <CachingRealm> <getUser("AppLayerRunAs")>
<Jul 17, 2002 8:53:49 AM EDT> <Debug> <CachingRealm> <user: pos HIT AppLayerRunAs>

This has been fixed in SP3.
-utpal

How to specify which group members have wiki write permissions

In the 10.5 Workgroup Manager, Basic tab, there are two drop down boxes after the checked boxes for enbabling wiki, blog, mailing lists, web calendar, et al -
Allow [group members only | some group members | authenticated users | anyone]
to write to these services.
If I select "some group members" how do I actually say which group members? I see nowhere that I can specify that.
Specifically this is in regards to the wiki.

Unless I'm missing something, the directory.app only lets me do the same thing the Server Admin does, add people to a group and enable services to that group.
For example I have a group called Techs, they have a mailing list and wiki.
Some of the junior techs I only want to have read access, others write access.
I don't see how I can specify user1 has read only access but user2 and user3 have write access.

Can't remove static members using "Manage Group Members"

Using the OAM 10.1.4.2 Group Manager app, I can remove static members from a group by modifying the Member property, but I can't remove members using the "Manage Group Members" page.
When I search for members using that page, I get a list of the current members with an unselected checkbox for each. If I check the box next to a member and click Save, the member is not removed from the group. I turned on trace-level logging and saw that the correct user is being passed to the Identity server to be removed, but I haven't yet found anything to indicate why the removal doesn't work.
Has anyone else run into this issue?
Thanks,
Matthew

Hi Vinod,
I'm running on Window 2003 against a Microsoft ADAM directory. I turned on diagnostics and re-ran the test using both "Manage Group Members" and modifying the property directly-- from what I can tell, the ldap modify only happens when I modify the property.
(I had also noticed the problem with the instructions, but I eventually figured it out-- if I can get this working, I'll have to fix the verbiage before I deploy.)
Any ideas? What platform and directory are you using?
Thanks,
Matthew

How can I set up an SMS group so that all group members can dial a group number and have a text sent out to all members of the group

How can I set up an SMS group so that all group members can dial a group number and have a text sent out to all members of the group
This would be an SMS group similar to an email listserv but running on the SMS network
I have seen private individuals offering this service
It seems strange to me that no internet site like Apple, Yahoo or Google offers this as a free service much as the email group services are free services.
Steve

I think the app GroupMe might do what you want. You might also try contacting your carrier. My carrier offered some fancy group texting service for a while but they never really advertised it so, unless you asked, you never would have known. But, GroupMe is available in the app store. There are lots of other apps that also do group texting but it seems to be the one that gets recommended the most.

How to show logged-in Line Group Members in a Hunt Pilot (CUCM V7.1.3)

I have configured a Hunt Pilot with a Hunt List which points to a Line Group with some DNs as Line Group Members. Additionally i gave the affected Users the option to log-in or log-out from the Hunt Pilot by configuring the "Hunt Group Logout" Button in the corresponding Phone Button Template.
Is there a way to find out who is logged-in or logged-out from the Hunt Pilot?

Hi Bill,
thanks for your very interesting hint .
I run the query you posted and actually got the following output. But the displayed linegroups are only a subset from my configured 79 linegroups . Is there a possibility to display all linegroups with all corresponding DNs and can i display this information for only one linegroup?
When i know the queery that satisfy my claims, i will write a small web application that uses the AXL-SOAP API.
Regards, Robert
admin:run sql select lg.name as LineGroup,n.dnorpattern,dhd.hlog from linegroup as lg inner join linegroupnumplanmap as lgmap on lgmap.fklinegroup=lg.pkid inner join numplan as n on lgmap.fknumplan = n.pkid inner join devicenumplanmap as dmap on dmap.fknumplan = n.pkid inner join device as d on dmap.fkdevice=d.pkid inner join devicehlogdynamic as dhd on dhd.fkdevice=d.pkid order by lg.name
linegroup                      dnorpattern     hlog
============================== =============== ====
LG_A-Ulr4_Augsburg_9965077_235 \+498215075234 f
LG_A-Ulr4_Augsburg_9965077_235 \+498215075209 f
LG_A-Ulr4_Augsburg_9965077_235 \+498215075224 f
LG_A-Ulr4_Augsburg_9965077_235 \+498215075226 f
LG_A-Ulr4_Augsburg_9965077_235 \+498215075227 f
LG_A-Ulr4_Augsburg_9965079_300 \+498215075327 f
LG_A-Ulr4_Augsburg_9965079_300 \+498215075306 f
LG_AB-Fried17_9965006          \+496021391713 f
LG_AB-Fried17_9965006          \+496021391714 f
LG_AB-Fried17_9965006          \+496021391721 f
LG_AB-Fried17_9965006          \+496021391727 f
LG_AM-Mar9_9965004             \+499621474921 f
LG_BT-Sch9_9965010             \+4992189423    f
LG_DD-Fet29_9965014            \+493514459055 t
LG_HO-Bah1_9965020             \+4992818194122 f
LG_KE-Moz31_9965024            \+498315215110 f
LG_LA-Dre11_9965025            \+498714308419 f
LG_LA-Dre12_9965026            \+498719239113 f
LG_Mue-Sta41_9965029           \+498631386227 f
LG_N-KOEN11_9965034            \+4991124039112 f
LG_N-KOEN11_9965034            \+4991124039142 f
LG_N-KOEN11_9965034            \+4991124039110 f
LG_N-Ste6_9965057_400          \+499112428403 f
LG_N-Ste6_9965058_450          \+499112428455 f
LG_NES-Sie2_9965008            \+499771610413 f
LG_NES-Sie2_9965008            \+499771610421 f
LG_NM-Bah12_9965030            \+499181293312 f
LG_PA-Kle13_9965035            \+498519594109 f
LG_PA-Kle13_9965035            \+498519594113 f
LG_PAN-Drb12_9965036           \+498561961225 t
LG_PAN-Drb12_9965036           \+498561961224 f
LG_R-Her2_9965068_400          \+499413783414 f
LG_TS-Bah26_9965040            \+498619887312 f
LG_Voicemail                   997005          t
LG_Voicemail                   997006          t
LG_Voicemail                   997007          t
LG_Voicemail                   997008          t
LG_Voicemail                   997009          t
LG_Voicemail                   997010          t
LG_Voicemail                   997011          t
LG_Voicemail                   997012          t
LG_Voicemail                   997013          t
LG_Voicemail                   997014          t
LG_Voicemail                   997015          t
LG_Voicemail                   997016          t
LG_Voicemail                   997017          t
LG_Voicemail                   997018          t
LG_Voicemail                   997019          t
LG_Voicemail                   997020          t
LG_Voicemail                   997021          t
LG_Voicemail                   997022          t
LG_Voicemail                   997023          t
LG_Voicemail                   997024          t
LG_Voicemail                   997025          t
LG_Voicemail                   997026          t
LG_Voicemail                   997027          t
LG_Voicemail                   997028          t
LG_WEN-Buer16_9965041          \+499614820413 t
LG_WEN-Buer16_9965041          \+499614820415 f
LG_WM-Puet35_9965042           \+49881922927   f
admin:

Missing group members in ADSI & LDAP

Similar Messages

Maybe you are looking for