I have a database with user &#39;dbo&#39; that has a login name &quot;domain\xzy&quot;.  How do I change it from &quot;domain\xzy&quot; to &quot;domain\abc&quot;.

Sql Server 2005 how to change dbo login name

Can anyone let me know if querying Active Directory server using ldapsearch, ldapadd, ldapdelete, etc. utilities is possible or not?

Querying Windows Active Directory server using ldapsearch from command line

I don&#39;t work with Microsoft but I&#39;m struggling understanding conceptually how AD, ADFS and LDAP work together.

Let&#39;s say I have an application that needs an Identity Provider. How does AD and LDAP come into play?

My googling hasn&#39;t come up with a clear summary of these concepts for me, but if there is a resource that exists, please do point me towards it.



AD vs ADFS vs LDAP: Explain it like I&#39;m 5

I am searching for a simple command to see logged on users on server.
I know this one :

    Get-WmiObject -Class win32_computersystem

but this will not provide me the info I need.
It returns :
domain
Manufactureer
Model
Name (Machine name)
PrimaryOwnerName
TotalPhysicalMemory

I run Powershell 3.0 on a Windows 2012 server.

Also 

    Get-WmiObject Win32_LoggedOnUser -ComputerName $Computer | Select Antecedent -Unique

gives me not the exact answers I need.
I would love to see as well the idle time, or if they are active or away.

Powershell script to see currently logged in users (domain and machine) + status (active, idle, away)

I&#39;m trying to run a simple LDAP query using directory services in .Net.

        DirectoryEntry directoryEntry = new DirectoryEntry(&quot;LDAP://someserver.contoso.com/DC=contoso,DC=com&quot;);
        directoryEntry.AuthenticationType = AuthenticationTypes.Secure;

        DirectorySearcher directorySearcher = new DirectorySearcher(directoryEntry);

        directorySearcher.Filter = string.Format(&quot;(&amp;(objectClass=user)(objectCategory=user) (sAMAccountName={0}))&quot;, username);

        var result = directorySearcher.FindOne();
        var resultDirectoryEntry = result.GetDirectoryEntry();

        return resultDirectoryEntry.Properties[&quot;msRTCSIP-PrimaryUserAddress&quot;].Value.ToString();


And I&#39;m getting the following exception:

    System.Runtime.InteropServices.COMException (0x80005000): Unknown error (0x80005000)
      at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail)
      at System.DirectoryServices.DirectoryEntry.Bind()
      at System.DirectoryServices.DirectoryEntry.get_AdsObject()
      at System.DirectoryServices.DirectorySearcher.FindAll(Boolean findMoreThanOne)
      at System.DirectoryServices.DirectorySearcher.FindOne()


As a snippet in a Console app, this works. But when I run it as part of a WCF service (run under the same credentials), it throws the above exception.

Any suggestions?

Thanks


Error 0x80005000 and DirectoryServices

I have found a lot of information from the past saying that [LDAP authentication isn&#39;t enabled yet but you can get around that using third party packages.][1]
However, it seems that LDAP authentication WAS [implemented back in January][2]. I can&#39;t seem to find any information on HOW to implement it.

I already have [custom authentication][3] set up in my project, I just need the logic to fill in the `HandleAuthenticateAsync` method.

I have tried using [other examples][4], but they don&#39;t seem to work with .NET Core 2.0.

Here is the only relevant code that I have that I can think of posting

    protected override Task&lt;AuthenticateResult&gt; HandleAuthenticateAsync()
    {
        // Get Authorization header value
        if (!Request.Headers.TryGetValue(HeaderNames.Authorization, out var authorization)) {
            return Task.FromResult(AuthenticateResult.Fail(&quot;Cannot read authorization header.&quot;));
        }

        // TODO: Authenticate user

        // Create authenticated user ticket
        var identities = new List&lt;ClaimsIdentity&gt; { new ClaimsIdentity(&quot;custom auth type&quot;) };
        var ticket = new AuthenticationTicket(new ClaimsPrincipal(identities), Options.Scheme);

        return Task.FromResult(AuthenticateResult.Success(ticket));

        // else User not authenticated
        return Task.FromResult(AuthenticateResult.Fail(&quot;Invalid auth key.&quot;));
    }

So, my question is, how do I implement LDAP Authentication in .NET Core 2.0?

  [1]: https://nicolas.guelpa.me/blog/2017/02/15/dotnet-core-ldap-authentication.html
  [2]: https://github.com/aspnetboilerplate/aspnetboilerplate/issues/2755
  [3]: https://stackoverflow.com/a/46118528/3103633
  [4]: https://stackoverflow.com/q/11561689/3103633

ASP.NET Core 2.0 LDAP Active Directory Authentication

I am writing the following methods to add and remove users from active directory in C#.


    void AddUserToGroup(string userId, string groupName);
    void RemoveUserFromGroup(string userId, string groupName);

How best to implement these methods?

Here is some code from CodeProject. I can&#39;t see where the AD server is specified in these examples though? (is it implicitly supplied by the .NET framework when using the LDAP protocol?). Are these examples worth following?

    public void AddToGroup(string userDn, string groupDn)
    {
        try
        {
            DirectoryEntry dirEntry = new DirectoryEntry(&quot;LDAP://&quot; + groupDn);
            dirEntry.Properties[&quot;member&quot;].Add(userDn);
            dirEntry.CommitChanges();
            dirEntry.Close();
        }
        catch (System.DirectoryServices.DirectoryServicesCOMException E)
        {
            //doSomething with E.Message.ToString();
    
        }
    }


    public void RemoveUserFromGroup(string userDn, string groupDn)
    {
        try
        {
            DirectoryEntry dirEntry = new DirectoryEntry(&quot;LDAP://&quot; + groupDn);
            dirEntry.Properties[&quot;member&quot;].Remove(userDn);
            dirEntry.CommitChanges();
            dirEntry.Close();
        }
        catch (System.DirectoryServices.DirectoryServicesCOMException E)
        {
            //doSomething with E.Message.ToString();
    
        }
    }

Adding and removing users from Active Directory groups in .NET

I need a way to see if a user is part of an active directory group from my .Net 3.5 asp.net c# application.

I am using the standard ldap authentication example off of msdn but I don&#39;t really see how to  check against a group.

See if user is part of Active Directory group in C# + Asp.net

I&#39;m having trouble with this command:

    gc .\domains.txt | Get-ADDomain

As the name implies, domains.txt contains a list of Active Directory to query (all domains are in the same forest).

If I run it on my Windows 8 machine everything works fine and I get the expected results, instead on a Windows 2008 R2 SP1 member server (not a DC) with WMF 3.0 I get result only from the first domain in the list and for the others:

    Get-ADDomain : A referral was returned from the server


If I query a domain in the list with:

    Get-ADDomain &lt;Domain name here&gt;

it works fine.

My Workstation
==============
Microsoft Windows 8 Enterprise (6.2.9200) x64

    PS D:\Tools\Powershell&gt; $PSVersionTable

    Name                           Value
    ----                           -----
    PSVersion                      3.0
    WSManStackVersion              3.0
    SerializationVersion           1.1.0.1
    CLRVersion                     4.0.30319.18010
    BuildVersion                   6.2.9200.16384
    PSCompatibleVersions           {1.0, 2.0, 3.0}
    PSRemotingProtocolVersion      2.2

Server
====
Microsoft Windows Server 2008 R2 Standard SP1 (6.1.7601) x64

    PS C:\Tools\Powershell&gt; $PSVersionTable

    Name                           Value
    ----                           -----
    WSManStackVersion              3.0
    PSCompatibleVersions           {1.0, 2.0, 3.0}
    SerializationVersion           1.1.0.1
    BuildVersion                   6.2.9200.16398
    PSVersion                      3.0
    CLRVersion                     4.0.30319.269
    PSRemotingProtocolVersion      2.2

Update
====

If i run on the server:

    gc .\domains.txt | %{ Get-ADDomain $_ }

it runs fine

TRACE
=====

    trace-command -Name ParameterBinding { &quot;DOMAIN_1&quot;,&quot;DOMAIN_2&quot; | Get-ADDomain } -PSHost

Server: http://pastebin.com/sRVJHaCU

Workstation: http://pastebin.com/kj3JV6nV

Thanks in advance

Powershell v3.0 pipe issue

I want to connect to our local Active Directory with C#.

I&#39;ve found [this good documentation](http://ianatkinson.net/computing/adcsharp.htm).

But I really don&#39;t get how to connect via LDAP.

Can somebody of you explain how to use the asked parameters?



Sample Code:

      static DirectoryEntry createDirectoryEntry()  
      {  
         // create and return new LDAP connection with desired settings  
      
         DirectoryEntry ldapConnection     = new DirectoryEntry(&quot;rizzo.leeds-art.ac.uk&quot;);  
         ldapConnection.Path               = &quot;LDAP://OU=staffusers,DC=leeds-art,DC=ac,DC=uk&quot;;  
         ldapConnection.AuthenticationType = AuthenticationTypes.Secure;  
         return ldapConnection;  
      }  

I just have the Hostname and the IP Address of our Active Directory Server. What does `DC=xxx,DC=xx` and so on mean?

Connect to Active Directory via LDAP

I need web access from Gradle through a proxy server to use the Gradle/Artifactory integration for Jenkins. To reduce possible causes for issues, I manually add the Artifactory plugin in build.gradle and run it from command line:

    apply {
        apply from: &quot;http://gradle.artifactoryonline.com/gradle/plugins/org/jfrog/buildinfo/build-info-extractor-gradle/1.0.1/artifactoryplugin-1.0.1.gradle&quot;
    }

Following [this](http://gradle.org/releases/0.8/docs/userguide/tutorial_this_and_that.html#sec:accessing_the_web_via_a_proxy) description I specified the following in .gradle/gradle.properties in my home directory:

    systemProp.http.proxyHost=hostname
    systemProp.http.proxyPort=8080
    systemProp.http.proxyUser=de\\username
    systemProp.http.proxyPassword=xxx

With the above proxy configuration (that is otherwise known to work), it fails:

&gt; 11:33:17.699 [ERROR] [org.gradle.BuildExceptionReporter] Caused by: java.io.IOException: Server returned HTTP response code: 407 for URL: http://gradle.artifactoryonline.com/gradle/plugins/org/jfrog/buildinfo/build-info-extractor-gradle/1.0.1/artifactoryplugin-1.0.1.gradle

I have two proxy servers to choose from, and one always responds with `407` (*Proxy authentication required*), the other with `502` (*Bad gateway*), so obviously, the proxyHost and proxyPort options are used.

As the user name (based on an Active Directory user) contains a backslash, I tried both `\\` and `\`, but neither worked. The user specified is different from the user that is logged in to the machine and Active Directory. This user&#39;s credentials aren&#39;t valid for the proxy, so I need to be able to specify a different user.

Setting the same options in Jenkins&#39; or Artifactory&#39;s GUI worked.


Gradle proxy configuration

PowerShell&#39;s [`Get-ADGroupMember`][1] cmdlet returns members of a specific group. Is there a cmdlet or property to get all the groups that a particular user is a member of? 

&lt;hr/&gt;

I fixed my mistake: [`Get-Member`][2] should be `Get-ADGroupMember`.

  [1]: https://technet.microsoft.com/en-us/library/ee617193.aspx
  [2]: http://technet.microsoft.com/en-us/library/hh849928.aspx


How to get all groups that a user is a member of?

Is there an equivalent tool available for use in Windows 7?  I just need to browse the membership of some small Active Directory groups that are deep within a huge hierarchy, so I can eventually write code to work with those groups.  The Windows Server 2003 version of the installer works, but the resulting MMC snap in just won&#39;t start up.

EDIT:
I&#39;d like to preemptively strike against more requests to close the question.  This is a tool that I assume many programmers use to assist in programming-related tasks such as testing code that modifies Active Directory content.  There are tons of other questions about developer tools here on Stack Overflow.

&quot;Active Directory Users and Computers&quot; MMC snap-in for Windows 7?

I have a search query in LDAP like this. What exactly does this query mean?

    (&quot;CN=Dev-India,OU=Distribution Groups,DC=gp,DC=gl,DC=google,DC=com&quot;);


What are CN, OU, DC in an LDAP search?

How can I get a list of users from active directory?  Is there a way to pull username, firstname, lastname?  I saw a similar post where this was used:

     PrincipalContext ctx = new PrincipalContext(ContextType.Domain, &quot;YOURDOMAIN&quot;);

I have never done anything with active directory so I am completely lost.  Any help would be greatly appreciated!



How can I get a list of users from active directory?

How can I validate a username and password against Active Directory? I simply want to check if a username and password are correct.


Validate a username and password against Active Directory?

I use this code to get the groups of the current user. But I want to manually give the user and then get his groups. How can I do this?

    using System.Security.Principal;

    public ArrayList Groups()
    {
        ArrayList groups = new ArrayList();

        foreach (IdentityReference group in System.Web.HttpContext.Current.Request.LogonUserIdentity.Groups)
        {
            groups.Add(group.Translate(typeof(NTAccount)).ToString());
        }

        return groups;
    }

How to get the groups of a user in Active Directory? (c#, asp.net)


I&#39;m looking for a way to authenticate users through LDAP with PHP (with Active Directory being the provider). Ideally, it should be able to run on IIS 7 ([adLDAP][1] does it on Apache). Anyone had done anything similar, with success?

* Edit: I&#39;d prefer a library/class with code that&#39;s ready to go... It&#39;d be silly to invent the wheel when someone has already done so.

  [1]: http://adldap.sourceforge.net/

Authenticating in PHP using LDAP through Active Directory

I often use the `net user` command to have a look at AD groups for a user:

    net user /DOMAIN &lt;username&gt;

This works well, however the group names are truncated to around 20 characters.  And in my organization, most group names are much longer than this.

Does anyone know of a way to get non-truncated AD groups through the command line?

Get user&#39;s non-truncated Active Directory groups from command line

How do I authenticate against AD using Python + LDAP. I&#39;m currently using the python-ldap library and all it is producing is tears.

I can&#39;t even bind to perform a simple query:

    import sys
    import ldap
    
    
    Server = &quot;ldap://my-ldap-server&quot;
    DN, Secret, un = sys.argv[1:4]
        
    Base = &quot;dc=mydomain,dc=co,dc=uk&quot;
    Scope = ldap.SCOPE_SUBTREE
    Filter = &quot;(&amp;(objectClass=user)(sAMAccountName=&quot;+un+&quot;))&quot;
    Attrs = [&quot;displayName&quot;]
    
    l = ldap.initialize(Server)
    l.protocol_version = 3
    print l.simple_bind_s(DN, Secret)
    
    r = l.search(Base, Scope, Filter, Attrs)
    Type,user = l.result(r,60)
    Name,Attrs = user[0]
    if hasattr(Attrs, &#39;has_key&#39;) and Attrs.has_key(&#39;displayName&#39;):
      displayName = Attrs[&#39;displayName&#39;][0]
      print displayName
    
    sys.exit()

Running this with `myusername@mydomain.co.uk password username` gives me one of two errors:

`Invalid Credentials` - When I mistype or intentionally use wrong credentials it fails to authenticate.

&gt;ldap.INVALID_CREDENTIALS: {&#39;info&#39;: &#39;80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 52e, vece&#39;, &#39;desc&#39;: &#39;Invalid credentials&#39;}

Or 

&gt;ldap.OPERATIONS_ERROR: {&#39;info&#39;: &#39;00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece&#39;, &#39;desc&#39;: &#39;Operations error&#39;}

What am I missing out to bind properly?

I am getting the same errors on fedora and windows.

Authenticating against active directory using python + ldap

What are the differences between LDAP and Active Directory?

How can I use a a search filter to display users of a specific group?

I&#39;ve tried the following:

    (&amp;
        (objectCategory=user)
        (memberOf=MyCustomGroup)
    )

and this:

    (&amp;
        (objectCategory=user)
        (memberOf=cn=SingleSignOn,ou=Groups,dc=tis,dc=eg,dc=ddd,D‌​C=com)
    )   

 

but neither display users of a specific group.

Query to list all users of a certain group

I have a very short PowerShell script that connects to a server and imports the AD module. I&#39;d like to run the script simply by double clicking, but I&#39;m afraid the window immediately closes after the last line.

How can I sort this out?


How to keep the shell window open after running a PowerShell script?

I have a simple task of authenticating against Active Directory using Java. Just verifying credentials and nothing else. Let&#39;s say my domain is &quot;fun.xyz.tld&quot;, OU path is unknown, and username/password is testu/testp. 

I know there&#39;s a few Java libraries out there that simplify this task, but I wasn&#39;t successful at implementing them. Most examples that I&#39;ve found addressed LDAP in general, not specifically Active Directory. Issuing LDAP request means sending an OU path in it, which I don&#39;t have. Also, the application that issues LDAP request should be already bound to Active Directory in order to access it... Insecure, since the credentials would have to be stored someplace discoverable. I would like a test bind with test credentials, if possible - this would mean that account is valid.

Last, if possible, is there a way to make such authentication mechanism encrypted? I know that AD uses Kerberos, but not sure if Java&#39;s LDAP methods do.

Does anyone has an example of working code? Thanks.

Authenticating against Active Directory with Java on Linux

I am throwing together a quick C# win forms app to help resolve a repetitive clerical job.

I have performed a search in AD for all user accounts and am adding them to a list view with check boxes.

I would like to default the listviewitems&#39; default check state to depend upon the enabled/disabled state of the account.

    string path = &quot;LDAP://dc=example,dc=local&quot;;
    DirectoryEntry directoryRoot = new DirectoryEntry(path);
    DirectorySearcher searcher = new DirectorySearcher(directoryRoot,
        &quot;(&amp;(objectClass=User)(objectCategory=Person))&quot;);
    SearchResultCollection results = searcher.FindAll();
    foreach (SearchResult result in results)
    {
        DirectoryEntry de = result.GetDirectoryEntry();
        ListViewItem lvi = new ListViewItem(
            (string)de.Properties[&quot;SAMAccountName&quot;][0]);
        // lvi.Checked = (bool) de.Properties[&quot;AccountEnabled&quot;]
        lvwUsers.Items.Add(lvi);
    }

I&#39;m struggling to find the right attribute to parse to get the state of the account from the DirectoryEntry object. I&#39;ve searched for [AD User attributes][1], but not found anything useful.

Can anyone offer any pointers?


  [1]: http://www.google.com/search?q=AD+User+attributes

How to determine if user account is enabled or disabled

I just noticed that the return list for results is limited to 1000. I have more than 1000 groups in my domain (HUGE domain). How can I get more than 1000 records? Can I start at a later record? Can I cut it up into multiple searches?

Here is my query:

    DirectoryEntry dirEnt = new DirectoryEntry(&quot;LDAP://dhuba1kwtn004&quot;);
    string[] loadProps = new string[] { &quot;cn&quot;, &quot;samaccountname&quot;, &quot;name&quot;, &quot;distinguishedname&quot; };
    DirectorySearcher srch = new DirectorySearcher(dirEnt, &quot;(objectClass=Group)&quot;, loadProps);
    var results = srch.FindAll();

I have tried to set **srch.SizeLimit = 2000;**, but that doesn&#39;t seem to work. Any ideas?


Can I get more than 1000 records from a DirectorySearcher?

Active Directory Certificate Services offers a [web service][1] that implements [MS-XCEP][2] and [MS-WSTEP][3] for non-domain connected computers to submit a certificate request.

This certificate can be used for digital signatures, encryption, and more.

Is there a WSDL I can use to interact with these web services?  How should I interact with them in C# or Javascript?


  [1]: https://serverfault.com/q/672141/51457
  [2]: https://msdn.microsoft.com/en-us/library/dd302869.aspx
  [3]: https://msdn.microsoft.com/en-us/library/dd340609.aspx

How do I use MS-XCEP and MS-WSTEP in .NET or JavaScript to get a certificate from AD CS?

At first I thought the code below works because if I have the group as &quot;IT&quot; it functions correctly because my username is in the IT group in active directory. What I learned is it always returns true whether I have my username in the IT group or not and if i change it to any other group I am in it returns always returns false. Any help would be appreciated.

        private void tabControl1_SelectedIndexChanged(object sender, EventArgs e)
        {
            // tab control security for admin tab
            bool admin = checkGroup(&quot;IT&quot;);

            if ((admin == true) &amp;&amp; (tabControl1.SelectedTab == tpHistory))
            {
                tabControl1.SelectedTab = tpHistory;
            }
            else if ((admin == false) &amp;&amp; (tabControl1.SelectedTab == tpHistory))
            {
                tabControl1.SelectedTab = tpRequests;
                MessageBox.Show(&quot;Unable to load tab. You have insufficient privileges.&quot;,
                    &quot;Access Denied&quot;, MessageBoxButtons.OK, MessageBoxIcon.Stop);
            }
        }

        // check active directory to see if user is in Marketing department group
        private static bool checkGroup(string group)
        {
            WindowsIdentity identity = WindowsIdentity.GetCurrent();
            WindowsPrincipal principal = new WindowsPrincipal(identity);
            return principal.IsInRole(group);
        }

How to check if a user belongs to an AD group?

I&#39;m currently researching methods for storing user roles and permissions for .NET based projects. Some of these projects are web based, some are not. I&#39;m currently struggling to find the best method to achieve what I&#39;m looking for in a consistent, portable way across project types.

Where I&#39;m at, we&#39;re looking to leverage Active Directory as our single point of contact for basic user information. Because of this, we&#39;re looking to not have to maintain a custom database for each application&#39;s users since they are already stored in Active Directory and actively maintained there. Additionally, we don&#39;t want to write our own security model/code if possible and would like to use something pre-existing, like the security application blocks provided by Microsoft.

Some projects require only basic privileges, such as read, write, or no access. Other projects require more complex permissions. Users of those applications might be granted access to some areas, but not others, and their permissions can change across each area. An administration section of the app would control and define this access, **not** the AD tools. 

Currently, we&#39;re using integrated Windows Authentication to perform authentication on our intranet. This works well for finding out basic user information, and I&#39;ve seen that ASP.NET can be extended to provide an Active Directory roles provider, so I can find out any security groups a user belongs to. But, what seems like the downfall of this method to me is that everything is stored in Active Directory, which could lead to a mess to maintain if things grow too big. 

Along this same line, I&#39;ve also heard of Active Directory Lightweight Directory Services, which seems like it could extend our schema and add only application specific attributes and groups. Problem is, I can&#39;t find anything on how this would be done or how this works. There are MSDN articles that describe how to talk to this instance and how to create a new instance, but nothing ever seems to answer my question.

**My question is:** Based on your experience, am I going down the right track? Is what I&#39;m looking to do possible using just Active Directory, or do other tools have to be used?

----------

**Other methods I&#39;ve looked into:**

 - Using multiple web.config files [[stackoverflow][1]]
 - Creating a custom security model and database to manage users across applications


  [1]: https://stackoverflow.com/questions/176338/customer-configurable-asp-net-web-site-security-for-fine-grained-control-of-page

User Group and Role Management in .NET with Active Directory

What are the high level steps to authenticate users of an ASP.NET MVC application against Active Directory?

I presume something like:

1. Modify web.config to use Windows authentication
2. Configure web.config to use the ActiveDirectoryMembershipProvider
3. Configure the web.config to use a custom RoleProvider that looks in AD

Does the above look sensible, and if so, where do I put the valid user detection logic?

In my case a valid user is someone on a specific AD domain.

Configure ASP.NET MVC for authentication against AD

(This is a question about a vague problem.  I try to present all relevant data, in the hope that someone has helpful information; apologies for the long description.)

**Our web app**

We have a .NET 4 web application running in IIS 7.5 accessing Active Directory and a SQL Server database.

This web application is running under a virtual &#39;app pool identity&#39;, by setting the Identity of the application&#39;s application pool to [ApplicationPoolIdentity](http://msdn.microsoft.com/en-us/library/bb386459.aspx).  A concise description of virtual identities can be found in [a StackOverflow answer](https://stackoverflow.com/a/3680803), and the blog post to which it refers: an app pool identity is just an additional group which is added to the web application&#39;s worker processes which is running as &#39;network service&#39;.  However, [one source](http://forums.iis.net/p/1171701/1957045.aspx#1957045) vaguely suggests that &quot;Network Service and ApplicationPoolIdentity do have differences that IIS.net site documents do not publish.&quot;  So a virtual identity might be more than just an additional group.

We chose to use ApplicationPoolIdentity, as opposed to NetworkService, because it became the default in IIS 7.5 (see, e.g., [here](http://msdn.microsoft.com/en-us/library/bb386459.aspx#attributesAndElementsToggle)), and per Microsoft&#39;s recommendation: &quot;This identity allows administrators to specify permissions that pertain only to the identity under which the application pool is running, thereby increasing server security.&quot; (from [processModel Element for add for applicationPools [IIS 7 Settings Schema]](http://msdn.microsoft.com/en-us/library/bb386459.aspx#attributesAndElementsToggle)) &quot;Application Pool Identities are a powerful new isolation feature&quot; which &quot;make running IIS applications even more secure and reliable. &quot; (from [IIS.net article &quot;Application Pool Identities&quot;](http://learn.iis.net/page.aspx/624/application-pool-identities/))

The application uses Integrated Windows Authentication, but with [`&lt;identity impersonate=&quot;false&quot;/&gt;`](http://msdn.microsoft.com/en-us/library/72wdk8cc.aspx), so that not the end user&#39;s identity but the virtual app pool identity is used to run our code.

This application queries Active Directory using the [System.DirectoryServices](http://msdn.microsoft.com/en-us/library/system.directoryservices.aspx) classes, i.e., the ADSI API.  In most places this is done without specifying an additional username/password or other credentials.

This application also connects to a SQL Server database using `Integrated Security=true` in the connection string.  If the database is local, then we see that `IIS APPPOOL\OurAppPoolName` is used to connect to the database; if the database is remote, then the machine account `OURDOMAIN\ourwebserver$` is used.

**Our problems**

We regularly have issues where a working installation starts to fail in one of the following ways.

 * When the database is on a remote system, then the database connection starts to fail: &quot;Login failed for user &#39;NT AUTHORITY\ANONYMOUS LOGON&#39;. Reason: Token-based server access validation failed with an infrastructure error. Check for previous errors.&quot;  The previous error is &quot;Error: 18456, Severity: 14, State: 11.&quot;  So it seems that now `OURDOMAIN\ourwebserver$` is not used anymore, but instead anonymous access is attempted.  (We have anecdotal evidence that this problem occurred when UAC was switched off, and that it went away after switching on UAC.  But note that changing UAC requires a reboot...)  A similar problem is reported in [IIS.net thread &quot;use ApplicationPoolIdentity to connect to SQL&quot;](http://forums.iis.net/t/1181039.aspx), specifically in [one reply](http://forums.iis.net/p/1181039/2010748.aspx#2010748).

 * Active Directory operations through ADSI (System.DirectoryServices) start to fail with error 0x8000500C (&quot;Unknown Error&quot;), 0x80072020 (&quot;An operations error occurred.&quot;), or 0x200B (&quot;The specified directory service attribute or value does not exist&quot;).

 * Signing in to the application from Internet Explorer starts to fail, with HTTP 401 errors.  But if in IIS we then put NTLM before Negotiate then it works again.  (Note that access to AD is needed for Kerberos but not for NTLM.)  A similar problem is reported in [IIS.net thread &quot;Window Authentication Failing with AppPool Identity&quot;](http://forums.iis.net/t/1171701.aspx).

**Our hypothesis and workaround**

At least the AD and sign-in problems always seem to go away when switching the application pool from ApplicationPoolIdentity to NetworkService.  (We found [one report](http://forums.iis.net/p/1181039/2010748.aspx#2010748) confirming this.)

Page [&quot;Troubleshooting Authentication Problems on ASP Pages&quot;](http://msdn.microsoft.com/en-us/library/ms180891.aspx) has some suggestions related to primary vs. secondary tokens, and what I find encouraging is that it links the first two of our errors: it mentions `NT AUTHORITY\ANONYMOUS LOGON` access, and AD errors 0x8000500C and &quot;The specified directory service attribute or value does not exist&quot;.

(The same page also mentions ADSI schema cache problems, but everything we can find on that topic is old.  For now we consider this to be unrelated.)

Based on the above, our current working *hypothesis* is that, only when running under a virtual app pool identity, *our web application (IIS? worker process?) suddenly loses its primary token*, so that IIS only has a secondary token, so that all access to Active Directory and SQL Server is done anonymously, leading to all of the above errors.

For now we intend to switch from ApplicationPoolIdentity to NetworkService.  Hopefully this makes all of the above problems go away.  But we are not sure; and we would like to switch back if possible.

**Our question**

Is the above hypothesis correct, and if so, is this a bug in IIS/Windows/.NET?  Under which circumstances does this primary token loss occur?


IIS application using application pool identity loses primary token?

Is it possible to create an LDAP query which will return (or check for) users in a nested group? e.g. UserA is a member of GroupA, and GroupA is a member of GroupB. I want a query on GroupB to return that UserA is a member. LDAP only. The server is Active Directory.

All Active Directory Solutions on Gang of Coders

Total of 32 Active Directory Solutions