AD Security Group Membership Viewing

Hello, Is there a tool/method that a regular Domain User can use to view AD
security group membership without giving them AD Users & Computers? Thanks

Meinolf
Thu Mar 27 15:41:42 PDT 2008

Hello BrianG,

Why not using ADUC? A domain user can only view the information provided
there, nothing else.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

> Hello, Is there a tool/method that a regular Domain User can use to
> view AD security group membership without giving them AD Users &
> Computers? Thanks
>

BrianG
Thu Mar 27 15:57:00 PDT 2008

I definitely thought about ADUC, but I figured there had to be some tool
already accessible in XP for a user to determine who is a member of an AD
security group before giving that group access.

"Meinolf Weber" wrote:

> Hello BrianG,
>
> Why not using ADUC? A domain user can only view the information provided
> there, nothing else.
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and confers
> no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
> > Hello, Is there a tool/method that a regular Domain User can use to
> > view AD security group membership without giving them AD Users &
> > Computers? Thanks
> >
>
>
>

Jorge
Thu Mar 27 16:00:45 PDT 2008

by using scripts or command line tooling for example
maybe even using a taskpad instead of using ADUC
http://blogs.dirteam.com/blogs/jorge/archive/2006/01/05/369.aspx


--

Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)

# Jorge de Almeida Pinto # MVP Windows Server - Directory Services #

BLOG (WEB-BASED)--> http://blogs.dirteam.com/blogs/jorge/default.aspx
BLOG (RSS-FEEDS)--> http://blogs.dirteam.com/blogs/jorge/rss.aspx
------------------------------------------------------------------------------------------
* How to ask a question --> http://support.microsoft.com/?id=555375
------------------------------------------------------------------------------------------
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always test ANY suggestion in a test environment before implementing!
------------------------------------------------------------------------------------------
#################################################
#################################################
------------------------------------------------------------------------------------------
"BrianG" <BrianG@newsgroup.nospam> wrote in message
news:B24CD456-78FD-45A6-9970-E2BE9E486757@microsoft.com...
> Hello, Is there a tool/method that a regular Domain User can use to view
> AD
> security group membership without giving them AD Users & Computers? Thanks

kj
Thu Mar 27 16:32:37 PDT 2008


"BrianG" <BrianG@newsgroup.nospam> wrote in message
news:B24CD456-78FD-45A6-9970-E2BE9E486757@microsoft.com...
> Hello, Is there a tool/method that a regular Domain User can use to view
> AD
> security group membership without giving them AD Users & Computers? Thanks

dsget for basics

http://technet2.microsoft.com/windowsserver/en/library/96a4a5ee-ee72-44d5-845f-71b2de33d4411033.mspx?mfr=true

and more effecient and elaborate tools like adfind.

http://www.joeware.net/freetools/index.htm

/kj

lforbes
Thu Mar 27 22:00:00 PDT 2008

Hi,

The way I do it is put all my security groups into a single OU.

I then run a custom MMC and add the ADUC snap in.

At the OU I want I right click and choose "new Window from here".

I then can enable taskpad view if I want it really simple.

I can setup the MMC as read only - File - Options - Limited User single
window.

Then save the MMC.

Now you will need to install adminpak.msi on the XP computers where you want
to use this mmc.

Now you can just give them the MMC.

I do this a lot for my Domain Users to reset passwords of users (which I
have delegated).

Cheers,
Lara

"BrianG" wrote:

> Hello, Is there a tool/method that a regular Domain User can use to view AD
> security group membership without giving them AD Users & Computers? Thanks

v-chanyin
Fri Mar 28 04:58:16 PDT 2008

Hello,

Thank you for your post and as well as to others for sharing these
information.

Yes, as James mentioned, you can use dsget command-line tool to view the
membership of a specified group in the domain. You can use it like:

Dsget group "CN=<GroupName>,OU=<OUName>,DC=abc,DC=com" -members (or
-memberof)

However, you may need to copy this dsget.exe command-line tool to the
Windows XP computers so that you can use it there.

Thank you and have a nice day!

Sincerely,
George Yin
Microsoft Online Support
Microsoft Global Technical Support Center

Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

Ken
Fri Mar 28 08:48:03 PDT 2008

While it is not a free solution, DSRAZOR for Windows will provide exactly
what you are asking for.
You can create a customized interface to allow people in your organization
to view or interact with Active Directory in the manner you choose. DSRAZOR
comes with a Designer that allows you to build your own interface. You
choose what you want your users to see, and what you want to hide from them.
You can also choose to give them some management capability. For example,
you could set up the applet to show group membership for just a couple
groups, then you could allow someone using the applet to remove users from
those groups, or add certain users to those groups. The list of users
available for a "group add" can be customized by using AD queries.
DSRAZOR allows you to delegate these kinds of tasks to your users in a very
controller manner. Go to our website if you would like a free one-on-one
web presentation with me so that I can show you how it works.

--
Ken Aldrich
DSRAZOR for Windows
Visual Click Software, Inc.
www.visualclick.com

"BrianG" <BrianG@newsgroup.nospam> wrote in message
news:B24CD456-78FD-45A6-9970-E2BE9E486757@microsoft.com...
> Hello, Is there a tool/method that a regular Domain User can use to view
> AD
> security group membership without giving them AD Users & Computers? Thanks

v-chanyin
Thu Apr 03 03:57:58 PDT 2008

Hello,

I am just writing to see how everything is going. If you have any updates
or need any further assistance on this issue, please feel free to let me
know. I am glad to be of assistance.

Sincerely,
George Yin
Microsoft Online Support
Microsoft Global Technical Support Center

Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.