Number of Users in a role

[Cathie]

Hi,

I am trying to work out how I can find the number of users in a role. So
that I can lock the application after a certain number of users are added to
that role.

Does any one know of decent reference material in dealing with windows users
and roles?

Cathie

[Joe Kaplan \(MVP - ADSI\)]

Are you talking about a role as in a Windows group a role you created in
your own code. .NET has a very flexible system that supports both.

In general, there are no .NET APIs that support this directly, but you might
be able to do something based on the specific implementation of the role.

Joe K.

"Cathie" <cathie@somewhere.com> wrote in message
news:OY4KncMNFHA.2736@TK2MSFTNGP09.phx.gbl...

> Hi,
>
> I am trying to work out how I can find the number of users in a role. So
> that I can lock the application after a certain number of users are added
> to that role.
>
> Does any one know of decent reference material in dealing with windows
> users and roles?
>
> Cathie
>

[Cathie]

I am looking for the number of users in a specific Windows group. I think I
know how to do it now, it just means that I will have to recursively search
the AD tree using DirectorySearch to and count the result.

Cathie

"Joe Kaplan (MVP - ADSI)" <joseph.e.kaplan@removethis.accenture.com> wrote
in message news:OH7Da5gNFHA.2580@TK2MSFTNGP09.phx.gbl...

> Are you talking about a role as in a Windows group a role you created in
> your own code. .NET has a very flexible system that supports both.
>
> In general, there are no .NET APIs that support this directly, but you
> might be able to do something based on the specific implementation of the
> role.
>
> Joe K.
>
> "Cathie" <cathie@somewhere.com> wrote in message
> news:OY4KncMNFHA.2736@TK2MSFTNGP09.phx.gbl...

>> Hi,
>>
>> I am trying to work out how I can find the number of users in a role. So
>> that I can lock the application after a certain number of users are added
>> to that role.
>>
>> Does any one know of decent reference material in dealing with windows
>> users and roles?
>>
>> Cathie
>>

>
>

[Joe Kaplan \(MVP - ADSI\)]

It is actually pretty hard to do this in general, but that is the basic
idea. You need to enumerate the members and then enumerate the members of
those groups that are also groups. If any of the groups have large numbers
of members (greater than maxRangeValue for your domain, typically 1000 for
win2k and 1500 for 2k3), then you'll also need some range retrieval.

Also, if any of those groups is the primary group, the membership isn't
included in the member attribute, so you need a different approach
altogether.

Why do you need to do this anyway?

Joe K.

"Cathie" <cathie@somewhere.com> wrote in message
news:OUd9aekNFHA.3336@TK2MSFTNGP09.phx.gbl...

>I am looking for the number of users in a specific Windows group. I think
>I know how to do it now, it just means that I will have to recursively
>search the AD tree using DirectorySearch to and count the result.
>
> Cathie
>
> "Joe Kaplan (MVP - ADSI)" <joseph.e.kaplan@removethis.accenture.com> wrote
> in message news:OH7Da5gNFHA.2580@TK2MSFTNGP09.phx.gbl...

>> Are you talking about a role as in a Windows group a role you created in
>> your own code. .NET has a very flexible system that supports both.
>>
>> In general, there are no .NET APIs that support this directly, but you
>> might be able to do something based on the specific implementation of the
>> role.
>>
>> Joe K.
>>
>> "Cathie" <cathie@somewhere.com> wrote in message
>> news:OY4KncMNFHA.2736@TK2MSFTNGP09.phx.gbl...

>>> Hi,
>>>
>>> I am trying to work out how I can find the number of users in a role.
>>> So that I can lock the application after a certain number of users are
>>> added to that role.
>>>
>>> Does any one know of decent reference material in dealing with windows
>>> users and roles?
>>>
>>> Cathie
>>>

>>
>>

>
>

[Cathie]

Named user check - for licensing issues :)

"Joe Kaplan (MVP - ADSI)" <joseph.e.kaplan@removethis.accenture.com> wrote
in message news:OV%23Q1nkNFHA.3788@tk2msftngp13.phx.gbl...

> It is actually pretty hard to do this in general, but that is the basic
> idea. You need to enumerate the members and then enumerate the members of
> those groups that are also groups. If any of the groups have large
> numbers of members (greater than maxRangeValue for your domain, typically
> 1000 for win2k and 1500 for 2k3), then you'll also need some range
> retrieval.
>
> Also, if any of those groups is the primary group, the membership isn't
> included in the member attribute, so you need a different approach
> altogether.
>
> Why do you need to do this anyway?
>
> Joe K.
>
> "Cathie" <cathie@somewhere.com> wrote in message
> news:OUd9aekNFHA.3336@TK2MSFTNGP09.phx.gbl...

>>I am looking for the number of users in a specific Windows group. I think
>>I know how to do it now, it just means that I will have to recursively
>>search the AD tree using DirectorySearch to and count the result.
>>
>> Cathie
>>
>> "Joe Kaplan (MVP - ADSI)" <joseph.e.kaplan@removethis.accenture.com>
>> wrote in message news:OH7Da5gNFHA.2580@TK2MSFTNGP09.phx.gbl...

>>> Are you talking about a role as in a Windows group a role you created in
>>> your own code. .NET has a very flexible system that supports both.
>>>
>>> In general, there are no .NET APIs that support this directly, but you
>>> might be able to do something based on the specific implementation of
>>> the role.
>>>
>>> Joe K.
>>>
>>> "Cathie" <cathie@somewhere.com> wrote in message
>>> news:OY4KncMNFHA.2736@TK2MSFTNGP09.phx.gbl...
>>>> Hi,
>>>>
>>>> I am trying to work out how I can find the number of users in a role.
>>>> So that I can lock the application after a certain number of users are
>>>> added to that role.
>>>>
>>>> Does any one know of decent reference material in dealing with windows
>>>> users and roles?
>>>>
>>>> Cathie
>>>>
>>>
>>>

>>
>>

>
>

[Joe Kaplan \(MVP - ADSI\)]

Gotcha. Good luck then! Make sure you test with large group memberships, a
mix of security and non-security groups and nested groups from other
domains. There are a variety of ways that this thing can get very
complicated and blow and give you trouble.

Joe K.

"Cathie" <cathie@somewhere.com> wrote in message
news:eL8UqpKOFHA.3076@TK2MSFTNGP14.phx.gbl...

> Named user check - for licensing issues :)
>
> "Joe Kaplan (MVP - ADSI)" <joseph.e.kaplan@removethis.accenture.com> wrote
> in message news:OV%23Q1nkNFHA.3788@tk2msftngp13.phx.gbl...

>> It is actually pretty hard to do this in general, but that is the basic
>> idea. You need to enumerate the members and then enumerate the members
>> of those groups that are also groups. If any of the groups have large
>> numbers of members (greater than maxRangeValue for your domain, typically
>> 1000 for win2k and 1500 for 2k3), then you'll also need some range
>> retrieval.
>>
>> Also, if any of those groups is the primary group, the membership isn't
>> included in the member attribute, so you need a different approach
>> altogether.
>>
>> Why do you need to do this anyway?
>>
>> Joe K.
>>