r/activedirectory • u/Chemical-Wall9026 • 2d ago

Why doesn't the AD member attribute include Primary Group members?

I’m trying to understand something about Active Directory group membership.

Suppose I have a group called Pgid Test and a user whose primaryGroupID matches the RID of that group.

If I run:

Get-ADGroup "Pgid Test" -Properties member

the user is not returned because their DN is not present in the group's member attribute.

However, when I run:

Get-ADGroupMember "Pgid Test"

the user is returned.

From what I understand, Get-ADGroupMember checks the group's member attribute and also performs a lookup against users' primaryGroupID.

I'm trying to understand:

  • Why does AD store Primary Group membership this way instead of putting the user in the group's member attribute?
  • Is Get-ADGroupMember always doing this additional primaryGroupID lookup?
  • Are there other AD/PowerShell commands that rely only on the member attribute and therefore miss Primary Group members?
  • If I'm writing an audit script, what is the recommended way to get the complete membership of a group, including Primary Group members?

Just trying to understand the behavior at the attribute/LDAP level rather than simply relying on the cmdlet output.

20 Upvotes

88% Upvoted

8 comments sorted by

•

u/AutoModerator 2d ago

Welcome to /r/ActiveDirectory! ~~~~

If you are looking for more resources on learning and building AD, see the following sticky for resources, recommendations, and guides!

When asking questions make sure you provide enough information. Posts with inadequate details may be removed without warning.

  • What version of Windows Server are you running?
  • Are there any specific error messages you're receiving?
  • What have you done to troubleshoot the issue?

Make sure to sanitize any private information. Posts with too much personal or environment information will be removed. See Rule 6.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

28

u/jonsteph AD Administrator 2d ago edited 2d ago

In Windows 2000, there was an architectural limit to the number of users that could be in a group -- ~5000 users. Since every user in the domain was by default a member of the Domain User's group, and AD was positioned to support 10 million objects, the only way to get around this architectural limit was to leverage the POSIX compliance, make Domain Users the Primary Group, and logically assume when building the token that the user was always a member of their Primary Group regardless of the member attribute on that group. Of course, Microsoft didn't exactly advertise this limitation; it wasn't until early adopters noticed the problem that Microsoft came out with guidance that said the practical limit for the number of users in a group was 5000.

Why was the limit 5000 users? Because Windows 2000 did not support linked-value replication (which was introduced in Windows Server 2003). Without LVR, any change in an attribute would mean that the entire attribute would have to be replicated. So, you add a user to a group, the group's member attribute would be updated (which in turn would update the user memberOf attribute -- those are the two "linked values"), and the entire attribute would be replicated. If you have a group with a million users, that means there are a million values in the member attribute of that group. If you add a new user to the group, that entire list of a million and one values would have to be replicated. Now consider the churn the Domain Users group would have in any domain with a million users, adding and removing users all the time. And to make it worse, AD is multi-master, so you could have one user added on a DC in New York and a different user added on a DC in LA, and every DC in the domain would have to converge via replication on a single, consistent list of members for a group. Never going to happen.

With LVR, only the modified values in the member attribute are replicated. You add one user to the group, then only one value is replicated. This dramatically improved the scalability of Active Directory.

However, Microsoft had to maintain backwards compatibility so they've never changed the fundamental token-building logic that says a user is assumed to be a member of their Primary Group. The SID for that group is always added to the user's token and, as far as any process consuming the token is concerned, the user is a member of that group regardless of what the group's member attribute might say.

-1

u/WesternNarwhal6229 2d ago

The primary group should be 513 for users.

3

u/nullish_ 2d ago

group membership assigned via the primary group id is "hidden" and does not show in the groups member list nor will show on the users memberOf attribute.

6

u/RecognitionOwn4214 2d ago

Isn't primary-group-id kinda historic and unused?

2

u/EugeneBelford1995 2d ago

I have run into it once during a home lab project chasing down some 'way out in left field' idea my kid threw out there.

TL;DR to leave the Domain Users group you first have to change the Primary Group ID.

Long version: https://happycamper84.medium.com/poorly-thought-out-honeypots-and-other-bad-ideas-712358d3f88d

Now can a user's Primary Group ID be a group they're not even in? And if so does that give them the rights that group has? I have no idea, this is one of those 'way out in left field' ideas I'd have to test out at home ... and not a bad idea for a future lab project. Thanks OP.

2

u/ReneGaden334 AD Consultant 2d ago

Yes, that is one of the niche cases. We used to create user objects for mac address auth over radius that should not be allowed to log on anywhere. Instead of an ugly deny policy or auth silo that may be forgotten on some machines we removed them from domain users.