How to force an update to a user’s group membership in Windows 7

authorizationgroupswindows 7

I am writing a web application that uses .NET Windows Authentication and relies on a user's group membership to Authorize them to various areas of the website. Right now I'm on a dev machine that IS NOT part of a domain and is not using AD, instead I'm just using local user groups. In general this is working fine as is.

However, as I test the application I need to add and remove roles in my user account to verify things are working. When I add a role it doesn't seem to propagate until I log out of Windows and login again.

Is it possible to force an update to Group membership without having to log off?

Best Answer

taskkill.exe /F /IM explorer.exe
runas /user:%USERDOMAIN%\%USERNAME% explorer.exe

This will kill explorer, then reopen with your user account... It will prompt you for your password and that will get you a new token, thereby updating your membership.

Related Solutions

Linux – Dump users and group membership to file

Here's a one liner:

getent passwd | awk -F ':' {'print $1'} | xargs -I {}  groups {} | sed 's/ : /:/g' | tr ' ' ','

This dumps straight to console like so:

pulse:pulse
shearn89:shearn89,apache,monit,wireshark

UPDATE: To get this in 'pure' .csv format, you could use this:

getent passwd | awk -F ':' {'print $1'} | xargs -I {}  groups {} | sed 's/ : /,/g' | tr ' ' ','

This would give you user,group1,group2,group3, so for users who are only in 'their' group, you'd get pulse,pulse (for example).

How to let non-admins manage selected domain groups’ membership

You can specify the managedBy attribute, and check the box for "Manager can update membership list". (This grants write permission for the Member attribute.)

The person(s) who need to edit the group may be able to do it with the DSQuery widget, for which you can create the following shortcut:

rundll32 dsquery,OpenQueryWindow

They can search for the group as with AD Users and Computers, then edit the properties, and Add members.

It may be possible to do this with Outlook (if the group is mail-enabled), but that can be more fragile if you have a multiple domain environment.

ManagedBy

enter image description here

Best Answer

Related Solutions

Linux – Dump users and group membership to file

How to let non-admins manage selected domain groups’ membership

Related Topic