When working with the access rules returned by
GetAccessRules(True, True, GetType(System.Security.Principal.NTAccount))
how can I tell if the NTAccount object referenced in each rule is a user account or a group?
Update:
I was able to solve this as follows. Note, the intent of this code is to return True
if the NTAccount
is a group, and False
otherwise or if an error occurs during checking.
Is there a better way to do this?
Public Function IsGroup(ByVal account As NTAccount) as Boolean
Dim samAccountName as string = account.Value
Dim accountNameParts() As String = samAccountName.Split("\")
If accountNameParts.Count() = 2 Then
Dim principalContext As PrincipalContext
Try
principalContext = New PrincipalContext(ContextType.Domain, accountNameParts(0))
Catch
Try
principalContext = New PrincipalContext(ContextType.Machine, accountNameParts(0))
Catch
principalContext = Nothing
End Try
End Try
If Not principalContext Is Nothing Then
Dim principal As Principal
principal = principal.FindByIdentity(principalContext, _samAccountName)
If Not principal Is Nothing then
return TypeOf principal Is GroupPrincipal
End If
End If
End If
Return False
End Function
Another update:
The above solution was okay for most server\account objects, but it fails for local group objects on the EMC Celerra NAS servers we have. I'm trying to use the NetUserGetInfo/NetLocalGroupGetInfo Win API calls to see if that will work, but I can't get them to work properly. See NetUserGetInfo/NetLocalGroupGetInfo returning error 1722 for more details.
The answer to this was indeed to use the Windows APIs (NetUserGetInfo
and NetLocalGroupGetInfo
).
Class NetApi
Private Declare Unicode Function NetUserGetInfo Lib "Netapi32.dll" ( _
ByVal ServerName As String, _
ByVal UserName As String, _
ByVal level As Integer, _
ByRef BufPtr As IntPtr) As Integer
Private Declare Unicode Function NetLocalGroupGetInfo Lib "Netapi32.dll" ( _
ByVal ServerName As String, _
ByVal GroupName As String, _
ByVal level As Integer, _
ByRef BufPtr As IntPtr) As Integer
Declare Unicode Function NetApiBufferFree Lib "netapi32.dll" _
(ByRef buffer As IntPtr) As Long
Public Shared Function PrincipalIsGroup(ByVal MachineName As String, ByVal AccountName As String) As String
If String.IsNullOrEmpty(MachineName) Then
Throw New ArgumentException("MachineName is Required")
End If
If String.IsNullOrEmpty(AccountName) Then
Throw New ArgumentException("AccountName is Required")
End If
Dim returnValue As String = "NotFound"
Dim bufPtr As IntPtr
Dim lngReturn As Integer = NetLocalGroupGetInfo("\\" & MachineName, AccountName, 0, bufPtr)
Call NetApiBufferFree(bufPtr)
bufPtr = IntPtr.Zero
If lngReturn = 0 Then
returnValue = "True"
Else
lngReturn = NetUserGetInfo("\\" & MachineName, AccountName, 0, bufPtr)
Call NetApiBufferFree(bufPtr)
bufPtr = IntPtr.Zero
If lngReturn = 0 Then
returnValue = "False"
End If
End If
Return returnValue
End Function
End Class