Read ntsecuritydescriptor of a group?

Question

Hi all,
I need to created objects in Active Directory with special ntSecurityDescriptors. Doing so for users is pretty easy, since I can configure an object in Active Directory, read its ntSecurityDescriptor and that's it.
Regarding groups I can so far write a value to ntSecurityDescriptor, but can't read it. Therefore it is quite hard to get a correct value for groups, since even the resource reference recommends not to create some value from scratch but to read an example from Active Directory and be done.
Any ideas how to solve that issue?
Any help would be greatly appreciated.
PS: Sun idm 8.0
CU,
Patrick.

Answer 1

I see your question was answered in the PowerShell forum. I was going to suggest a similar solution:
Get-ADGroupMember
-Identity "Your Group" |
Where {$_.distinguishedName
-Like "*,ou=Sales,ou=West,dc=*" |
Select Name
Unfortunately, the distinguishedName attribute is the only one that indicates the parent OU/Container where the object resides in AD, and you can only filter on an exact match in AD. You cannot use wildcards to filter DN syntax attributes. So you must retrieve
all members of the group and use a Where clause to parse distinguished name (with the -Like operator). The other solution suggested retrieves all users in the specified OU (using Get-ADUser) and filters on those where the memberOf attribute includes the distinguished
name of the group. That also works.
Richard Mueller - MVP Directory Services