title: "GetAuthorizationGroups" throws exception when reading groups for user from Active Directory
body: <p>I'm trying to find groups via <code>GetAuthorizationGroups</code>, and it's sort of working in that I can get an IEnumerable back, but most of the items I get back throw an exception when I try to read them:</p>
  
  <pre><code>System.Runtime.InteropServices.COMException:
  The specified directory service attribute or value does not exist.
  </code></pre>
  
  <p>If you plug in your own domain, container, and username, you should get a list of their groups:</p>
  
  <p>Powershell:</p>
  
  <pre><code>[System.Reflection.Assembly]::LoadWithPartialName("System.DirectoryServices.AccountManagement")
  [System.Reflection.Assembly]::LoadWithPartialName("System.DirectoryServices")
  [System.Reflection.Assembly]::LoadWithPartialName("System.DirectoryServices.ActiveDirectory")
  
  $username = "a-user-such-as-yourself"
  
  $principalContext = new-object -TypeName System.DirectoryServices.AccountManagement.PrincipalContext "Domain", "yourADdomain.com", "OU=whatever,OU=andever,DC=yourADdomain,DC=com"
  
  $principal = [System.DirectoryServices.AccountManagement.UserPrincipal]::FindByIdentity($principalContext, $username)
  
  $groups = $principal.GetAuthorizationGroups()
  Write-Output $groups
  </code></pre>
  
  <p>If I ignore all the exceptions, it successfully returns the groups "Everyone", "Authenticated Users", and a couple more, but throws an exception on others.</p>
  
  <p><em>If I run this as a Domain Admin it works fine, returning all groups without any exceptions.</em> </p>
  
  <p><em>So I'm assuming that the user running this needs some sort of permission in Active Directory. But which one?</em></p>