title: Active Directory: DirectoryEntry member list <> GroupPrincipal.GetMembers()
body: <p>I have a group, lets call it GotRocks. I am attempting to get all of its members, but I am getting wildly different results count-wise between DirectoryEntry and AccountManagement. Below are the counts by member retrieval method:</p>
  
  <pre><code>Method 1: DirectoryEntry.PropertyName.member = 350
  Method 2: AccountManagement.GroupPrincipal.GetMembers(false) = 6500
  Method 2: AccountManagement.GroupPrincipal.GetMembers(true) = 6500
  </code></pre>
  
  <p>As a sanity check, I went into ADUC and pulled the list of members from the group, which is limited to 2,000 by default. The important thing here is that ADUC seems to validate the AccountManagement result. I have checked the Children property as well, but it is blank. Also, none of the members listed in DirectoryEntry are of the SchemaName group - they are all users.</p>
  
  <p>I do not think this is a code problem, but perhaps a lack of understanding of how DirectoryEntry and the GetMembers methods retrieve group members. Can anyone explain why the DirectoryEntry member list would yield a different result from the GetMembers recursive function? Is there a certain method or property I need to be aware of? Note: I have built a function that will query DirectoryEntry by "member;range={0}-{1}" where the loop gets members in chunks of 1,500. I am at a complete and utter loss here.</p>
  
  <p>The fact that DirectoryEntry is returning so few results is problematic because I want to use DirectoryEntry for the simple fact that going this route is, at a minimum, two orders of magnitude faster than AccountManagement (i.e., stopwatch times of 1,100 milliseconds versus 250,000 milliseconds).</p>
  
  <p><strong>UPDATE 1: Methods:</strong></p>
  
  <p>Method 1: DirectoryEntry</p>
  
  <pre><code>private List&lt;string&gt; GetGroupMemberList(string strPropertyValue, string strActiveDirectoryHost, int intActiveDirectoryPageSize)
  {
      // Variable declaration(s).
      List&lt;string&gt; listGroupMemberDn = new List&lt;string&gt;();
      string strPath = strActiveDirectoryHost + "/&lt;GUID=" + strPropertyValue + "&gt;";
      string strMemberPropertyRange = null;
      DirectoryEntry directoryEntryGroup = null;
      DirectorySearcher directorySearcher = null;
      SearchResultCollection searchResultCollection = null;
      // https://msdn.microsoft.com/en-us/library/windows/desktop/ms676302(v=vs.85).aspx
      const int intIncrement = 1500;
  
      // Load the DirectoryEntry.
      try
      {
          directoryEntryGroup = new DirectoryEntry(strPath, null, null, AuthenticationTypes.Secure);
  
          directoryEntryGroup.RefreshCache();
      }
      catch (Exception)
      { }
  
      try
      {
          if (directoryEntryGroup.Properties["member"].Count &gt; 0)
          {
              int intStart = 0;
  
              while (true)
              {
                  int intEnd = intStart + intIncrement - 1;
  
                  // Define the PropertiesToLoad attribute, which contains a range flag that LDAP uses to get a list of members in a pre-specified chunk/block of members that is defined by each loop iteration.
                  strMemberPropertyRange = string.Format("member;range={0}-{1}", intStart, intEnd);
  
                  directorySearcher = new DirectorySearcher(directoryEntryGroup)
                  {
                      Filter = "(|(objectCategory=person)(objectCategory=computer)(objectCategory=group))", // User, Contact, Group, Computer objects
  
                      SearchScope = SearchScope.Base,
  
                      PageSize = intActiveDirectoryPageSize,
  
                      PropertiesToLoad = { strMemberPropertyRange }
                  };
  
                  try
                  {
                      searchResultCollection = directorySearcher.FindAll();
  
                      foreach (SearchResult searchResult in searchResultCollection)
                      {
                          var membersProperties = searchResult.Properties;
  
                          // Find the property that starts with the PropertyName of "member;" and get all of its member values.
                          var membersPropertyNames = membersProperties.PropertyNames.OfType&lt;string&gt;().Where(n =&gt; n.StartsWith("member;"));
  
                          // For each record in the memberPropertyNames, get the PropertyName and add to the lest.
                          foreach (var propertyName in membersPropertyNames)
                          {
                              var members = membersProperties[propertyName];
  
                              foreach (string memberDn in members)
                              {                                   
                                  listGroupMemberDn.Add(memberDn);
                              }
                          }
                      }
                  }
                  catch (DirectoryServicesCOMException)
                  {
                      // When the start of the range exceeds the number of available results, an exception is thrown and we exit the loop.
                      break;
                  }
  
                  intStart += intIncrement;
              }
          }
  
          return listGroupMemberDn;
      }
      finally
      {
          listGroupMemberDn = null;
          strPath = null;
          strMemberPropertyRange = null;
          directoryEntryGroup.Close();
          if(directoryEntryGroup != null) directoryEntryGroup.Dispose();                
          if (directorySearcher != null) directorySearcher.Dispose();
          if(searchResultCollection != null) searchResultCollection.Dispose();
      }
  }
  </code></pre>
  
  <p>Method 2: AccountManagement (toggle bolRecursive as either true or false).</p>
  
  <pre><code>private List&lt;Guid&gt; GetGroupMemberList(string strPropertyValue, string strDomainController, bool bolRecursive)
  {
      // Variable declaration(s).
      List&lt;Guid&gt; listGroupMemberGuid = null;
      GroupPrincipal groupPrincipal = null;
      PrincipalSearchResult&lt;Principal&gt; listPrincipalSearchResult = null;
      List&lt;Principal&gt; listPrincipalNoNull = null;
      PrincipalContext principalContext = null;
      ContextType contextType;
      IdentityType identityType;
  
      try
      {
          listGroupMemberGuid = new List&lt;Guid&gt;();
  
          contextType = ContextType.Domain;
  
          principalContext = new PrincipalContext(contextType, strDomainController);
  
          // Setup the IdentityType. Use IdentityType.Guid because GUID is unique and never changes for a given object. Make sure that is what strPropertyValue is receiving.
          // This is required, otherwise you will get a MultipleMatchesException error that says "Multiple principals contain a matching Identity."
          // This happens when you have two objects that AD thinks match whatever you're passing to UserPrincipal.FindByIdentity(principalContextDomain, strPropertyValue)
          identityType = IdentityType.Guid;
  
          groupPrincipal = GroupPrincipal.FindByIdentity(principalContext, identityType, strPropertyValue);
  
          if (groupPrincipal != null)
          {
              // Get all members that the group contains and add it to the list.
              // Note: The true flag in GetMembers() specifies a recursive search, which enables the application to search a group recursively and return only principal objects that are leaf nodes.
              listPrincipalSearchResult = groupPrincipal.GetMembers(bolRecursive);
  
              // Remove the nulls from the list, otherwise the foreach loop breaks prematurly on the first null found and misses all other object members.
              listPrincipalNoNull = listPrincipalSearchResult.Where(item =&gt; item.Name != null).ToList();
  
              foreach (Principal principal in listPrincipalNoNull)
              {
                  listGroupMemberGuid.Add((Guid)principal.Guid);
              }
          }
  
          return listGroupMemberGuid;
      }
      catch (MultipleMatchesException)
      {
          // Multiple principals contain a matching identity. 
          // In other words, the same property value was found on more than one record in either of the six attributes that are listed within the IdentityType enum.
          throw new MultipleMatchesException(strPropertyValue);
      }
      finally
      {
          // Cleanup objects.
          listGroupMemberGuid = null;
          if(listPrincipalSearchResult != null) listPrincipalSearchResult.Dispose();
          if(principalContext != null) principalContext.Dispose();
          if(groupPrincipal != null) groupPrincipal.Dispose();
      }
  }
  </code></pre>
  
  <p><strong>UPDATE 2:</strong></p>
  
  <pre><code>public static void Main()
  {
      Program objProgram = new Program();
  
      // Other stuff here.
  
      objProgram.GetAllUserSingleDc();
  
      // Other stuff here.
  }
  
  private void GetAllUserSingleDc()
  {
      string strDomainController = "domain.com"; 
      string strActiveDirectoryHost = "LDAP://" + strDomainController;
      int intActiveDirectoryPageSize = 1000;
      string[] strAryRequiredProperties = null;
      DirectoryEntry directoryEntry = null;
      DirectorySearcher directorySearcher = null;
      SearchResultCollection searchResultCollection = null;
      DataTypeConverter objConverter = null;
      Type fieldsType = null;
  
      fieldsType = typeof(AdUserInfoClass);
  
      objConverter = new DataTypeConverter();
  
      directoryEntry = new DirectoryEntry(strActiveDirectoryHost, null, null, AuthenticationTypes.Secure);
  
      directorySearcher = new DirectorySearcher(directoryEntry)
      {
          //Filter = "(|(objectCategory=person)(objectCategory=computer)(objectCategory=group))", // User, Contact, Group, Computer objects
          Filter = "(sAMAccountName=GotRocks)", // Group
  
          SearchScope = SearchScope.Subtree,
  
          PageSize = intActiveDirectoryPageSize
  
          PropertiesToLoad = { "isDeleted","isCriticalSystemObject","objectGUID","objectSid","objectCategory","sAMAccountName","sAMAccountType","cn","employeeId",
                              "canonicalName","distinguishedName","userPrincipalName","displayName","givenName","sn","mail","telephoneNumber","title","department",
                              "description","physicalDeliveryOfficeName","manager","userAccountControl","accountExpires","lastLogon","logonCount","lockoutTime",
                              "primaryGroupID","pwdLastSet","uSNCreated","uSNChanged","whenCreated","whenChanged","badPasswordTime","badPwdCount","homeDirectory",
                              "dNSHostName" }
      };         
  
      searchResultCollection = directorySearcher.FindAll();            
  
      try
      {
          foreach (SearchResult searchResult in searchResultCollection)
          {
              clsAdUserInfo.GidObjectGuid = objConverter.ConvertByteAryToGuid(searchResult, "objectGUID");            
              clsAdUserInfo.StrDirectoryEntryPath = strActiveDirectoryHost + "/&lt;GUID=" + clsAdUserInfo.GidObjectGuid + "&gt;";
              clsAdUserInfo.StrSchemaClassName = new DirectoryEntry(clsAdUserInfo.StrDirectoryEntryPath, null, null, AuthenticationTypes.Secure).SchemaClassName;
  
              if (clsAdUserInfo.StrSchemaClassName == "group")
              {
                  // Calling the functions here.
                  List&lt;string&gt; listGroupMemberDnMethod1 = GetGroupMemberListStackOverflow(clsAdUserInfo.GidObjectGuid.ToString(), strActiveDirectoryHost, intActiveDirectoryPageSize);
  
                  List&lt;Guid&gt; listGroupMemberGuidMethod2 = GetGroupMemberList(clsAdUserInfo.GidObjectGuid.ToString(), strDomainController, false)
              }   
              // More stuff here.
          }
      }
      finally
      {
          // Cleanup objects.
          // Class constructors.
          objProgram = null;
          clsAdUserInfo = null;
          // Variables.
          intActiveDirectoryPageSize = -1;
          strActiveDirectoryHost = null;
          strDomainController = null;
          strAryRequiredProperties = null;
          directoryEntry.Close();
          if(directoryEntry !=null) directoryEntry.Dispose();
          if(directorySearcher != null) directorySearcher.Dispose();
          if(searchResultCollection != null) searchResultCollection.Dispose();
          objConverter = null;
          fieldsType = null;
      }   
  }
  </code></pre>
  
  <p><strong>UPDATE 3:</strong></p>
  
  <p>Below is the list of namespaces that I am <code>using</code>.</p>
  
  <pre><code>using System;
  using System.Collections.Generic;
  using System.DirectoryServices;
  using System.DirectoryServices.AccountManagement;
  using System.Security.Principal;
  using System.Text;
  using System.Linq;
  using System.Collections;
  </code></pre>
  
  <p><strong>UPDATE 4: Program.cs</strong></p>
  
  <pre><code>using System;
  using System.Collections.Generic;
  using System.DirectoryServices;
  using System.DirectoryServices.AccountManagement;
  using System.Security.Principal;
  using System.Text;
  using System.Linq;
  
  namespace activeDirectoryLdapExamples
  {
      public class Program
      {
           public static void Main()
          {
              Program objProgram = new Program();
              objProgram.GetAllUserSingleDc();
          }
  
          #region GetAllUserSingleDc
          private void GetAllUserSingleDc()
          {
              Program objProgram = new Program();
              string strDomainController = "EnterYourDomainhere";
              string strActiveDirectoryHost = "LDAP://" + strDomainController;
              int intActiveDirectoryPageSize = 1000;
              DirectoryEntry directoryEntry = null;
              DirectorySearcher directorySearcher = null;
              SearchResultCollection searchResultCollection = null;
              DataTypeConverter objConverter = null;
  
              objConverter = new DataTypeConverter();
  
              directoryEntry = new DirectoryEntry(strActiveDirectoryHost, null, null, AuthenticationTypes.Secure);
  
              directorySearcher = new DirectorySearcher(directoryEntry)
              {
                  Filter = "(sAMAccountName=GotRocks)", // Group
  
                  SearchScope = SearchScope.Subtree,
  
                  PageSize = intActiveDirectoryPageSize,
  
                  PropertiesToLoad = { "isDeleted","isCriticalSystemObject","objectGUID","objectSid","objectCategory","sAMAccountName","sAMAccountType","cn","employeeId",
                                          "canonicalName","distinguishedName","userPrincipalName","displayName","givenName","sn","mail","telephoneNumber","title","department",
                                          "description","physicalDeliveryOfficeName","manager","userAccountControl","accountExpires","lastLogon","logonCount","lockoutTime",
                                          "primaryGroupID","pwdLastSet","uSNCreated","uSNChanged","whenCreated","whenChanged","badPasswordTime","badPwdCount","homeDirectory",
                                          "dNSHostName" }
              };
  
              searchResultCollection = directorySearcher.FindAll();
  
              try
              {
                  foreach (SearchResult searchResult in searchResultCollection)
                  {                    
                      Guid? gidObjectGuid = objConverter.ConvertByteAryToGuid(searchResult, "objectGUID");
                      string StrSamAccountName = objConverter.ConvertToString(searchResult, "sAMAccountName");
                      // Get new DirectoryEntry and retrieve the SchemaClassName from it by binding the current objectGUID to it.
                      string StrDirectoryEntryPath = strActiveDirectoryHost + "/&lt;GUID=" + gidObjectGuid + "&gt;";
                      string StrSchemaClassName = new DirectoryEntry(StrDirectoryEntryPath, null, null, AuthenticationTypes.Secure).SchemaClassName;
  
                      #region GetGroupMembers
                      if (StrSchemaClassName == "group")
                      {
                          // FAST!
                          var watch = System.Diagnostics.Stopwatch.StartNew();
                          List&lt;string&gt; listGroupMemberDn = GetGroupMemberList(gidObjectGuid.ToString(), strActiveDirectoryHost, intActiveDirectoryPageSize);
                          watch.Stop();
                          var listGroupMemberDnElapsedMs = watch.ElapsedMilliseconds;
  
                          // SLOW!
                          watch = System.Diagnostics.Stopwatch.StartNew();
                          List&lt;Guid&gt; listGroupMemberGuidRecursiveTrue = GetGroupMemberList(gidObjectGuid.ToString(), strDomainController, true);
                          watch.Stop();
                          var listGroupMemberGuidRecursiveTrueElapsedMs = watch.ElapsedMilliseconds;
  
                          watch = System.Diagnostics.Stopwatch.StartNew();
                          List&lt;Guid&gt; listGroupMemberGuidRecursiveFalse = GetGroupMemberList(gidObjectGuid.ToString(), strDomainController, false);
                          watch.Stop();
                          var listGroupMemberGuidRecursiveFalseElapsedMs = watch.ElapsedMilliseconds;
  
                          ////// Display all members of the list.
                          //listGroupMemberDn.ForEach(item =&gt; Console.WriteLine("Member GUID: {0}", item));
                          //listGroupMemberGuidRecursiveTrue.ForEach(item =&gt; Console.WriteLine("Member GUID: {0}", item));
                          //listGroupMemberGuidRecursiveFalse.ForEach(item =&gt; Console.WriteLine("Member GUID: {0}", item));
  
                          Console.WriteLine("objectGUID: {0}", gidObjectGuid);
                          Console.WriteLine("sAMAccountName: {0}", strSamAccountName);
  
                          // Result: 350
                          Console.WriteLine("\nlistGroupMemberDn Count Members: {0}", listGroupMemberDn.Count);
                          Console.WriteLine("Total RunTime listGroupMemberDnElapsedMs (in milliseconds): {0}", listGroupMemberDnElapsedMs);
  
                          // Result: 6500
                          Console.WriteLine("\nlistGroupMemberGuidRecursiveTrue Count Members: {0}", listGroupMemberGuidRecursiveTrue.Count);
                          Console.WriteLine("Total RunTime listGroupMemberGuidRecursiveTrueElapsedMs (in milliseconds): {0}", listGroupMemberGuidRecursiveTrueElapsedMs);
  
                          // Result: 6500
                          Console.WriteLine("\nlistGroupMemberGuidRecursiveFalse Count Members: {0}", listGroupMemberGuidRecursiveFalse.Count);
                          Console.WriteLine("Total RunTime listGroupMemberGuidRecursiveFalseElapsedMs (in milliseconds): {0}", listGroupMemberGuidRecursiveFalseElapsedMs);
                          Console.WriteLine("\n");
                      }
                      #endregion
  
                      #region CurrentSearchResult
                      else
                      {
                          Console.WriteLine("ObjectGuid = {0}", gidObjectGuid);
                          Console.WriteLine("SamAccountName = {0}", strSamAccountName);
  
                      }
                      #endregion
                  }
  
                  Console.WriteLine("\nPress any key to continue.");
                  Console.ReadKey();
              }
              finally
              {
                  objProgram = null;
                  intActiveDirectoryPageSize = -1;
                  strActiveDirectoryHost = null;
                  strDomainController = null;
                  directoryEntry.Close();
                  if (directoryEntry != null) directoryEntry.Dispose();
                  if (directorySearcher != null) directorySearcher.Dispose();
                  if (searchResultCollection != null) searchResultCollection.Dispose();
                  objConverter = null;
              }
          }
          #endregion
  
          #region GetGroupMemberListGuid
          private List&lt;Guid&gt; GetGroupMemberList(string strPropertyValue, string strDomainController, bool bolRecursive)
          {
              List&lt;Guid&gt; listGroupMemberGuid = null;
              List&lt;Principal&gt; listPrincipalNoNull = null;
              GroupPrincipal groupPrincipal = null;
              PrincipalSearchResult&lt;Principal&gt; listPrincipalSearchResult = null;
              PrincipalContext principalContext = null;
              ContextType contextType;
              IdentityType identityType;
  
              try
              {
                  listGroupMemberGuid = new List&lt;Guid&gt;();
  
                  contextType = ContextType.Domain;
  
                  principalContext = new PrincipalContext(contextType, strDomainController);
  
                  identityType = IdentityType.Guid;
  
                  groupPrincipal = GroupPrincipal.FindByIdentity(principalContext, identityType, strPropertyValue);
  
                  if (groupPrincipal != null)
                  {
                      listPrincipalSearchResult = groupPrincipal.GetMembers(bolRecursive);
  
                      listPrincipalNoNull = listPrincipalSearchResult.Where(item =&gt; item.Name != null).ToList();
  
                      foreach (Principal principal in listPrincipalNoNull)
                      {
                          listGroupMemberGuid.Add((Guid)principal.Guid);
                      }
                  }
  
                  return listGroupMemberGuid;
              }
              catch (MultipleMatchesException)
              {
                  throw new MultipleMatchesException(strPropertyValue);
              }
              finally
              {
                  // Cleanup objects.
                  listGroupMemberGuid = null;
                  listPrincipalNoNull = null;
                  principalContext = null;
                  if (groupPrincipal != null) groupPrincipal.Dispose();
                  if (listPrincipalSearchResult != null) listPrincipalSearchResult.Dispose();
                  if (principalContext != null) principalContext.Dispose();
              }
          }
          #endregion
  
          #region GetGroupMemberListDn
          private List&lt;string&gt; GetGroupMemberList(string strPropertyValue, string strActiveDirectoryHost, int intActiveDirectoryPageSize)
          {
              List&lt;string&gt; listGroupMemberDn = new List&lt;string&gt;();
              string strPath = strActiveDirectoryHost + "/&lt;GUID=" + strPropertyValue + "&gt;";
              const int intIncrement = 1500; // https://msdn.microsoft.com/en-us/library/windows/desktop/ms676302(v=vs.85).aspx
  
              var members = new List&lt;string&gt;();
  
              // The count result returns 350.
              var group = new DirectoryEntry(strPath, null, null, AuthenticationTypes.Secure);
              //var group = new DirectoryEntry($"LDAP://{"EnterYourDomainHere"}/&lt;GUID={strPropertyValue}&gt;", null, null, AuthenticationTypes.Secure);
  
              while (true)
              {
                  var memberDns = group.Properties["member"];
                  foreach (var member in memberDns)
                  {
                      members.Add(member.ToString());
                  }
  
                  if (memberDns.Count &lt; intIncrement) break;
  
                  group.RefreshCache(new[] { $"member;range={members.Count}-*" });
              }
              return members;
          }
          #endregion
  
          #region DataTypeConvert
          private class DataTypeConverter
          {
              public DataTypeConverter() { }
  
              public String ConvertToString(SearchResult searchResult, string strPropertyName)
              {
                  String bufferObjectString = null;
  
                  try
                  {
                      bufferObjectString = (String)this.GetPropertyValue(searchResult, strPropertyName);
  
                      if (string.IsNullOrEmpty(bufferObjectString))
                      {
                          return null;
                      }
                      else
                      {
                          return bufferObjectString;
                      }
                  }
                  finally
                  {
                      bufferObjectString = null;
                  }
              }
  
              public Guid? ConvertByteAryToGuid(SearchResult searchResult, string strPropertyName)
              {
                  Guid? bufferObjectGuid = null;
  
                  try
                  {
                      bufferObjectGuid = new Guid((Byte[])(Array)this.GetPropertyValue(searchResult, strPropertyName));
  
                      if (bufferObjectGuid == null || bufferObjectGuid == Guid.Empty)
                      {
                          throw new NullReferenceException("The field " + strPropertyName + ", of type GUID, can neither be NULL nor empty.");
                      }
                      else
                      {
                          return bufferObjectGuid;
                      }
                  }
                  finally
                  {
                      bufferObjectGuid = null;
                  }
              }
          }
          #endregion
      }
  }
  </code></pre>