title: LDAP_MATCHING_RULE_IN_CHAIN not working with default AD groups - Domain Users
body: <p>In my program, I need to fetch all the AD groups for a user.
  The current version of my program uses System.DirectoryServices.AccountManagement.UserPrincipal.GetAuthorizationGroups.</p>
  
  <p>This works good until we had a new customer with a much largeer AD. There it is really slow. (Up to 60 seconds)</p>
  
  <p>Now I've been looking around, and saw the posts that the AccountManagement is easy to use, but slow.</p>
  
  <p>I also found that LDAP_MATCHING_RULE_IN_CHAIN should also fetch all the nested groups that a user is member of. And is more performant.</p>
  
  <p>From <a href="https://social.technet.microsoft.com/Forums/ie/en-US/f238d2b0-a1d7-48e8-8a60-542e7ccfa2e8/recursive-retrieval-of-all-ad-group-memberships-of-a-user?forum=ITCG" rel="nofollow noreferrer">this</a> link.</p>
  
  <p>But I'm having an issue with the default groups that in AD exists.</p>
  
  <p>For example the group "Domain Users" is not returned by the function.
  They also have a group "BDOC" that as member have "Domain Users". That group is also not returned.</p>
  
  <p>Trough the GetAuthorizationGroups it is returned correct.</p>
  
  <p>I'm using following code to fetch the groups by user.</p>
  
  <p><strong>VB.NET:</strong></p>
  
  <pre><code>Dim strFilter As String = String.Format("(member:1.2.840.113556.1.4.1941:={0})", oUserPrincipal.DistinguishedName)
  Dim objSearcher As New DirectoryServices.DirectorySearcher("LDAP://" &amp; oLDAPAuthenticationDetail.Domain &amp; If(Not String.IsNullOrWhiteSpace(oLDAPAuthenticationDetail.Container), oLDAPAuthenticationDetail.Container, String.Empty))
  objSearcher.PageSize = 1000
  objSearcher.Filter = strFilter
  objSearcher.SearchScope = DirectoryServices.SearchScope.Subtree
  objSearcher.PropertiesToLoad.Add(sPropGuid)
  objSearcher.PropertiesToLoad.Add(sPropDisplayName)
  
  
  Dim colResults As DirectoryServices.SearchResultCollection = objSearcher.FindAll()
  </code></pre>
  
  <p>Afterwards I was testing with the script from the link, if it was possible to fetch all the users from the Domain Users group, by changing the "member" to "memberOf" in the filter.
  When I put the Domain Admins group in the filter, it shows the admins correct.
  When I put the Domain Users group in the filter, it returns nothing.</p>
  
  <p><strong>Powershell:</strong></p>
  
  <pre><code>$userdn = 'CN=Domain Users,CN=Users,DC=acbenelux,DC=local'
  $strFilter = "(memberOf:1.2.840.113556.1.4.1941:=$userdn)"
  $objDomain = New-Object System.DirectoryServices.DirectoryEntry("LDAP://rootDSE")
  $objSearcher = New-Object System.DirectoryServices.DirectorySearcher
  $objSearcher.SearchRoot = "LDAP://$($objDomain.rootDomainNamingContext)"
  $objSearcher.PageSize = 1000
  $objSearcher.Filter = $strFilter
  $objSearcher.SearchScope = "Base"
  $colProplist = "name"
  foreach ($i in $colPropList)
  {
      $objSearcher.PropertiesToLoad.Add($i) &gt; $nul
  }
  $colResults = $objSearcher.FindAll()
  foreach ($objResult in $colResults)
  {
      $objItem = $objResult.Properties
      $objItem.name
  }
  </code></pre>
  
  <p>I don't know what I'm doing wrong. Or is it maybe just not possible to fetch the "default groups" with that filter?
  What is a good alternative then?</p>