Adding an AD User to a Machine Local group via AccountManagement

Question

I wanted to implement adding an AD user to a local machine group via User and GroupPrincipals, and I thought it would work nice and easy. Unfortunately, I continue to get a General Access Denied error. It's possible I just don't understand the proper authentication happening, but I assumed I had the proper access set up. Here is a code snippet of what is being called:

var ctx = new PrincipalContext(ContextType.Machine,
                               Environment.MachineName,
                               ConfigurationManager.AppSettings["MyUser"],
                               ConfigurationManager.AppSettings["MyPW"]);

        var grp = GroupPrincipal.FindByIdentity(ctx, IdentityType.Name, "LocalGrp");
        var adUser = ADService.GetUserByDomainUserName(vModel.ContactId);

        var adCtx = new PrincipalContext(ContextType.Domain,
                                         "myDomain.com",
                                         ConfigurationManager.AppSettings["MyUser"],
                                         ConfigurationManager.AppSettings["MyPW"])
                                              ;
        var user = UserPrincipal.FindByIdentity(adCtx, 
                                                IdentityType.Guid,
                                                adUser.UserGuid.ToString());

        if (grp != null &&
            user != null)
        {
            if(!user.IsMemberOf(grp))
            {
                grp.Members.Add(user);
                grp.Save();
            }
        }

The user is found, the group is found, but when I add and reach the grp.Save() step, I am treated with a General Access Denied exception. with the ctx being opened via the "MyUser" and "MyPW", I thought that would allow group manipulation on the machine since that account is part of the machine local administrators group. Can I not mix machine/domain contexts in this manner, or is there an authentication problem I am just missing?

score 0 · Answer 1 · edited Jan 18 '13 at 22:24

0

Did you run Visual Studio in Admin mode. Even though your login has admin rights, your program needs to elevate itself to use those rights if you didn't start it elevated.

See:

edited Jan 18 '13 at 22:24

eldarerathis

35,455
10
90
93

answered Aug 13 '12 at 18:42

CiteHistory Study

36
2

I will try this, but I also ran it on a development server and it behaved the same way - denying access even though the Identity in the App Pool (and the username/pw used when creating the contexts) are part of the machine administrator group. – J_D Aug 13 '12 at 18:49

Adding an AD User to a Machine Local group via AccountManagement

1 Answers1