active-directoryldapmemberof

Why builtin security groups not in the attribute memberOf?

If I query the AD then for some users the attribute memberOf does not contains any builtin groups. The users with the problem are all moved in a separate OU.

The query is simple:

(&(objectClass=person)(uid=xyz))

But the "Active Directory Users and Computers" tool from Microsoft show this members. Where can be the problem? Is this an access right problem?

Solution

  • There is a notion of a Primary group in AD. The default is usually Domain Users.

    This is represented on the user object as an attribute called PrimaryGroupID, and 513 is Domain Users.

    There can and must be only one primary group, and to remove the current one, you need to first add another group as a member, to then swap with the primary group ID.