AD adding user to a group in a different domain

[Mathias Alvarsson]

In the creation-process of the new user, I also wan't to add it to a group
that exists in another domain in the same forrest. When I try this I get
these error-messages: "The object was not found on the server" or "The
server was unwilling to process the request".

I'm using the following code to add a user to a group:
string sGroupPath =
"LDAP://server1.domain1.test.com/CN=Test,CN=Users,DC=domain1,DC=test,DC=com"
;
string sUserPath =
"LDAP://server2.domain2.test.com/CN=John,CN=Users,DC=domain2,DC=test,DC=com"
;
DirectoryEntry oGroup = new DirectoryEntry( sGroupPath );
oGroup.Invoke("Add", new Object[] {sUserPath });

If I run the group-addingcode manually after the user has been replicated
between the domains, it works ok. But how do I do this in the same process
that creates the AD-user?

/Mathias

 

[Marc Scheuner [MVP ADSI]]

I'm using the following code to add a user to a group:

string sGroupPath =
"LDAP://server1.domain1.test.com/CN=Test,CN=Users,DC=domain1,DC=test,DC=com"
;
string sUserPath =
"LDAP://server2.domain2.test.com/CN=John,CN=Users,DC=domain2,DC=test,DC=com"
;
DirectoryEntry oGroup = new DirectoryEntry( sGroupPath );
oGroup.Invoke("Add", new Object[] {sUserPath });

First of all, you don't need to go the complicated way of invoking the
"Add" method on the group's native IADsGroup interface - just use the
group's "Children.Add" method.

Secondly, when adding a user to a group, you only have to specify the
user's DN - e.g. anything from the CN= part on. Do not specify the
LDAP:// and the server!

Thirdly, there are a number of issues mostly with permissions and
trusts when doing this - so you might run into problems based on your
setup.

So now, try this, and see if it works:

string sUserPath = "CN=John,CN=Users,DC=domain2,DC=test,DC=com"
DirectoryEntry oGroup = new DirectoryEntry( sGroupPath );
oGroup.Children.Add(sUserPath)

Marc

 

[Mathias Erlandsson]

I tried as you suggested, but it didn't work. I got no error-messages at
all. Any ideas?

/Mathias

I'm using the following code to add a user to a group:
string sGroupPath =
"LDAP://server1.domain1.test.com/CN=Test,CN=Users,DC=domain1,DC=test,DC=com

"

;
string sUserPath =
"LDAP://server2.domain2.test.com/CN=John,CN=Users,DC=domain2,DC=test,DC=com

"

;
DirectoryEntry oGroup = new DirectoryEntry( sGroupPath );
oGroup.Invoke("Add", new Object[] {sUserPath });

First of all, you don't need to go the complicated way of invoking the
"Add" method on the group's native IADsGroup interface - just use the
group's "Children.Add" method.

Secondly, when adding a user to a group, you only have to specify the
user's DN - e.g. anything from the CN= part on. Do not specify the
LDAP:// and the server!

Thirdly, there are a number of issues mostly with permissions and
trusts when doing this - so you might run into problems based on your
setup.

So now, try this, and see if it works:

string sUserPath = "CN=John,CN=Users,DC=domain2,DC=test,DC=com"
DirectoryEntry oGroup = new DirectoryEntry( sGroupPath );
oGroup.Children.Add(sUserPath)

Marc