Permissions required to retrieve local group members with ADSI

user_2100305 0
Viewed 784

Using ADSI I can query the members of the local Administrator group on a given computer by doing (for example in PowerShell) :

([ADSI]"WinNT://computer-name/Administrators,Group").Invoke("members")

To do this, as far as I can tell, the user running the PowerShell script requires Administrator privileges on the target machine - that is, the user needs to be directly on indirectly in the local administrator group of computer-name (eg. by being a member of "Domain Admins").

This surprised me because a non-administrator account who can login to computer-name (eg. a user that's part of "Domain Users" and nothing else) can open the local users & groups application, and view the members of the local administrator group. No specific rights are required when doing it manually, yet ADSI seems to require it.

So my questions are:

  • Is it correct that using ADSI you need Administrator rights to access this information, or am I doing something wrong?
  • Is there a different approach to programmatically obtain this information, which requires less privileges than an Administrator account ? (If there are solutions that are not available in PowerShell that's fine, my targets are C#/.NET Core )

Please note I want to run this remotely on other workstations - not just on the local workstation.

adsi .net-core windows c#
2 Answers

ADSI is built on top of WMI. By default, only the local Administrators group is allowed to make remote WMI calls and read a computers local directory data.

You can change the permissions on the OS by going into Computer Management (local) -> Services and Applications -> WMI Control. Right click on WMI Control and choose Properties.

I've only experimented with allowing all reads, which you can set on the root folder. I did some research and you may be able to restrict this to just LDAP. On the Security tab drill down to Root -> directory -> LDAP. You'll want to adjust permissions on the LDAP entry (or maybe more?). The key permission is Remote Enable.

Update

To query WMI directly from PowerShell.

Remote WMI over PowerShell: https://docs.microsoft.com/en-us/windows/win32/wmisdk/connecting-to-wmi-on-a-remote-computer.

Custom PowerShell method for listing remote group membership through WMI: https://gallery.technet.microsoft.com/scriptcenter/List-local-group-members-c25dbcc4

user_3289680

I think your ADSI approach should work, at least when executed locally.

I used a c# snippet I grabbed from this SO answer: https://stackoverflow.com/a/8192062/3374994.

To test whether it could run from regular user permissions, I used Runas /user:regularuser GetLocalUsers.exe.

I believe this shows that an ADSI approach would not necessarily require elevated privileges.

However, was your intention to run the code remotely?

var path = string.Format("WinNT://{0},computer", Environment.MachineName);

        using (var computerEntry = new DirectoryEntry(path))
        {
            var userNames = from DirectoryEntry childEntry in computerEntry.Children
                where childEntry.SchemaClassName == "User"
                select childEntry.Name;

            foreach (var name in userNames)
                Console.WriteLine(name);
        }
user_33749940
Related