Member Avatar for riahc3

Im doing some work with C# and AD and Im missing something right now that I cant seem to see.

I want to get a description of a security group in Active Directory and use that in a tooltip.

I have all the security groups but Im not sure how to get that description.

Here is the code for security groups (and additional non working code for trying to get the description field)

    /* ABOVE THIS THERE IS A LOT MORE CODE BUT THIS IS THE PART THAT LOADS THE GROUPS FROM AD AND ALSO PUTS IT IN A COMBOBOX */
            //Groups:
            // create your domain context
            PrincipalContext ctx = new PrincipalContext(ContextType.Domain, "domain.com");

            // define a "query-by-example" principal - here, we search for a GroupPrincipal 
            GroupPrincipal qbeGroup = new GroupPrincipal(ctx);

            // create your principal searcher passing in the QBE principal    
            PrincipalSearcher srch = new PrincipalSearcher(qbeGroup);

            // find all matches
            foreach (var found in srch.FindAll())
            {
                if (found.DistinguishedName.Contains("OU=DOMAIN,DC=domain,DC=com"))
                {
                    Globals.groups.Add(found.SamAccountName);
                    if (!Globals.groups.Contains("excludedgroup1") && !Globals.groups.Contains("excludedgroup2"))
                    {
                        Globals.tooltipforgroups.Add(found.Description);
                    }

                }
                // do whatever here - "found" is of type "Principal" - it could be user, group, computer.....          
            }

            var array = Globals.groups.Distinct().ToArray();

            foreach (string x in array)
            {
                if (x != "excludedgroup1" && x != "excludedgroup2")
                {
                    comboBoxDepart.Items.Add(x);

                }

            }

Im obviously missing something very obvious.

  • 2 Contributors
  • 3 Replies
  • 308 Views
  • 2 Weeks Discussion Span
  • Latest Post Latest Post by rproffitt

Dani AI

Generated

Short answer: the group description is the AD attribute named "description". With System.DirectoryServices.AccountManagement you can read GroupPrincipal.Description when it's populated, and fall back to the underlying DirectoryEntry's Properties["description"] when it's not. Also avoid keeping two parallel lists (names + tooltip list) — use a dictionary (group → description) so items never get out of sync.

The code below shows a robust pattern: enumerate groups, read Description or the DirectoryEntry fallback, store results in a case‑insensitive Dictionary, populate the ComboBox from that dictionary, and set the tooltip on selection.

using System.DirectoryServices;
using System.DirectoryServices.AccountManagement;

var descriptions = new Dictionary<string,string>(StringComparer.OrdinalIgnoreCase);

using (var ctx = new PrincipalContext(ContextType.Domain, "domain.com"))
using (var searcher = new PrincipalSearcher(new GroupPrincipal(ctx)))
{
    foreach (Principal p in searcher.FindAll())
    {
        string sam = p.SamAccountName ?? p.Name;
        string desc = p.Description;
        if (string.IsNullOrWhiteSpace(desc))
        {
            var de = p.GetUnderlyingObject() as DirectoryEntry;
            desc = de?.Properties["description"]?.Value as string;
        }
        descriptions[sam] = desc ?? "";
        p.Dispose();
    }
}

foreach (var kv in descriptions.OrderBy(k => k.Key))
{
    if (kv.Key.Equals("excludedgroup1", StringComparison.OrdinalIgnoreCase)) continue;
    comboBoxDepart.Items.Add(kv.Key);
}

comboBoxDepart.SelectedIndexChanged += (s,e) =>
{
    var key = comboBoxDepart.SelectedItem as string;
    if (key != null && descriptions.TryGetValue(key, out var d))
        toolTip1.SetToolTip(comboBoxDepart, d);
};

Notes and troubleshooting: your original code added names then used Globals.groups.Contains(...) as the exclusion test — that checks the whole list instead of the current group name and can cause logic errors. Also Principal.Description can be null if the AD attribute is empty or your search/filter excluded the object; check the OU filter, domain/context and permissions. For single-group lookups GroupPrincipal.FindByIdentity or an LDAP DirectorySearcher with (sAMAccountName=...) are simpler alternatives. This approach avoids index mismatches and reliably surfaces the AD description.

Recommended Answers

All 3 Replies

Member Avatar for rproffitt

I took a look into this and came away a little worn. That is, I didn't find any specific example where this is. So if I had to do this I'd find out if any of the command line tools report this. Then I can research how it did that.

Member Avatar for riahc3

Helps 0 with modifying the code I have

Member Avatar for rproffitt

I have a few books on the subject but none revealed more than what I found with googles. Sorry you haven't found an answer yet.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.