I am using SystemDirectorySevices to get user information from on-prem active directory from a machine not joined to the domain. The following code to get the user's domain name was working from a domain-joined machine, but not from a non-domain-joined machine.

public static string GetDomainName(this SecurityIdentifier sid)
{
    string? ntAccount = sid.Translate(typeof(NTAccount)).ToString();    
    return ntAccount.Split('\\')[0];
}

I need the domain name, as in MyDomain\myuser, but I assume the above method depends on a relationship with the domain controller. What are my options in this scenario? Thanks.

Update: Thanks to answers below, this is what worked for me:

var user = new DirectoryEntry($"GC://my.company.com:636/<SID={sid}>", "username", "password", AuthenticationTypes.Encryption);

The above gives me a "A referral was returned from the server" result. I inspect ref 1 in the ExtendedErrorMessage property to get the correct server. Then I query the correct server as shown below.

var user = new DirectoryEntry($"LDAP://other.my.company.com/<SID={sid}>", "username", "password", AuthenticationTypes.ServerBind);

Notice a few things I had to change between the calls in my case:

1. GC protocol to LDAP
2. Removed port number
3. Changed AuthenticationType to ServerBind

CodePudding user response：

You can do this, but only if:

1. You know the DNS name of the domain that it's on,
2. You have network connectivity to it, and
3. You have credentials you can use to authenticate to the domain.

public static string GetDomainName(this SecurityIdentifier sid)
{
    var user = new DirectoryEntry($"LDAP://example.com/<SID={sid}>", "username", "password");
    user.RefreshCache(new [] {"msDs-PrincipalName"});
    return ((string)user.Properties["msDs-PrincipalName"].Value).Split('\\')[0];
}

Replace example.com with the DNS name of your domain, and username and password with your credentials.

I understand that it's possible that if you don't know the short name of the domain, you don't know the DNS name either, which will present a challenge. If that's the case, do you at least know the AD forest that the domain is in (if it's a multi-domain forest)?