ldapsearch missing "Domain Users" security group from returned list

[LexSplunker]

I have taken a rather long query and condensed it down to the following to remove any possibility that something was possibly filtering it out.

| ldapsearch search="(&(cn=*userhere*))"

That will output all of the available data for the user including memberOf. memberOf skips "Domain Users" but seems to display every other group.

I am currently running 3.0.8 of Splunk Supporting Add-on for Active Directory. Release notes do not mention this issue, no one seems to be reporting this issue but I have confirmed it happening on two completely independent instances. Both were 3.0.8.

[LexSplunker]

The reason for using this is to be able to create a list of all groups a user is in.

That above query will evaluate and memberOf still does not show "Domain Users" but shows every other group. The documentation makes no mention that the primary group ID will not show up, unfortunately the network I am currently on I am unable to add a test user and assign the primary group to something else and remove them from Domain Users but I can't see how it would be normal functionality to exclude the primary group the user is a member of.

I have just never in my career seen something that could list group memberships and would intentionally skip the primary group, or "Domain Users" whichever is true in this scenario.

I tested with Domain Computers as well and had the same results. It still seems weird.

[sainag_splunk · Accepted solution]

Thanks for your feedback.  Based on what I  know, this seems to be normal behavior for AD, not an issue with the add-on. If you are having trouble please  consider working with splunk support or ods who has expertise on the AD integration.

[LexSplunker]

Hello!

You are correct. I had to dig into it and found out that the primaryGroupID is considered an "implicit membership." It is uncommon to change but Guest is 514, as an example. The issue happens with the Guest user account as well since it is (traditionally) only a member of the security group called Domain Guests.

I was able to confirm this using the Windows LDP tool. Apparently, I just never had to use LDAP to actually query for all memberships in the past, it was always using third-party tools which would include even the "implicit" memberships.

[sainag_splunk]

@LexSplunker  I think thats normal behavior not an add-on issue?. did you already try  something like this ? I always specify the attributes I need because of the  special handling and performance.

| ldapsearch search="(&(cn=*userhere*))" attrs="cn,memberOf,primaryGroupID" | eval primaryGroupName=if(primaryGroupID="513","Domain Users","Other Primary Group")

refer: https://docs.splunk.com/Documentation/SA-LdapSearch/3.0.2/User/UseSA-ldapsearchtotroubleshootproblem...



If this reply Helps, Please Upvote.