How to distinguish between users and groups assigned to a folder security?

Question

I wrote a simple code to retrieve security information of a folder the information contain User and groups and the rights they have on the folder

public void GetSecurityRules(DirectoryInfo directoryInfo)
    {
        DirectorySecurity DSecurity = directoryInfo.GetAccessControl();
        AuthorizationRuleCollection Rules = DSecurity.GetAccessRules(true, true, typeof(NTAccount));


        foreach (FileSystemAccessRule fileSystemAccessRule in Rules)
        {
            Console.WriteLine("User/Group name {0}",fileSystemAccessRule.IdentityReference.Value);
            Console.WriteLine("Permissions: {0}", fileSystemAccessRule.FileSystemRights.ToString());
        }
    }

In the line fileSystemAccessRule.IdentityReference.Value I got both Users and Groups but how can i know if the value represent a user or a group?

Answer 1

To the best of my knowledge, the CLR does not expose this information. You will have to p/invoke LsaLookupSids manually and examine the SID_NAME_USE value it will return. CLR calls this function too in order to translate SIDs to account names, but it throws away the SID_NAME_USE values. For code, break out your Reflector, open mscorlib and see how the internal TranslateToNTAccounts function in System.Security.Principal.SecurityIdentifier works.

As an alternative, if you are not going to do such lookups repeatedly, it might be easier to use WMI — query a Win32_Account by SID and examine the SIDType member.