How do I extract Active Directory Group and Forest metadata from an Active Directory Domain Server

Question

Problem statement

I need to make finding all the available active directory groups and their relationships in a tree and forest structure for each an every enterprise application held on an AD Domain Server easy to identify and understand by business user and technical users via an Existing IT Service Request web based application.

What I am hoping to achieve as an outcome is:

1. Knowledge of an API that I can connect to extract this metadata from and synchronise with the IT Service Request Application

2. Knowledge of what metadata AD Domain Servers are capable of providing

3. Knowledge of how to connect and synchronise the meta data from the IT Service Request Web based Application without compromising security

Answer 1

You didn't say which language you want to use. I will assume you will use one of the .NET languages, since that is by far the easiest to interact with AD.

To read the Active Directory Schema, you can use ActiveDirectorySchema.GetCurrentSchema(). That will return a ActiveDirectorySchema object that you can use to read much of the information you would want to know. There are example for how to use it here.

For your 3rd point: to read this data you have to be authenticated as a user of that domain (or a trusted domain). Authentication is already built in. When you use ActiveDirectorySchema.GetCurrentSchema(), for example, it uses the credentials of the current user to authenticate.