tokenGroups attribute

[waynegs]

Can anyone tell me what permission needs to be given to a user account so it can view the tokengroups attribute for all domain users?

I am trying to help our admin setup a user account that I will be able to use in a .net application I am working on. I need to be able to give this function a SID and get the groups the user is in.

It works fine if I use a domain admin account to access ldap, but with anything else, the tokenGroups attribute comes back empty.

thanks,

Wayne

 

[kmkeshav]

http://support.microsoft.com/kb/301916

I hope this will give you some clue.

-Keshav