Why the primary group of Local Administrators appears as Domain Users {S-1-5-21-<domain>-513}

508 Views Asked by At

I have a text file that the Local Administrator is the owner of the file.
When I am running the following code:

public static void CheckPermissions(string filePath)
{
    FileSecurity acl = new FileInfo(filePath).GetAccessControl();
    IdentityReference group = acl.GetGroup(typeof(SecurityIdentifier));
    IdentityReference owner = acl.GetOwner(typeof(SecurityIdentifier));
}  

It shows:

group = {S-1-5-21-<domain>-513}  // DOMAIN_USERS group
owner = {S-1-5-21-<domain>-500}  // Local Administrator

The GetGroup function according to Microsoft:

Gets the primary group associated with the specified owner.

But the primary group associated to the local administrator is Domain Users ?

EDIT:
When I checked with the GUI it shows two groups:
enter image description here

1

There are 1 best solutions below

0
E235 On BEST ANSWER

I confused with the terms.

The GetGroup function according to Microsoft:

Gets the primary group associated with the specified owner.

The GetOwner function according to Microsoft:

Gets the owner associated with the specified primary group.

So it seems that nothing was wrong with the question.
Just need to understand what meaning of the functions.
For example, the GetGroup gets the primary group associated with the specified owner.

So if the owner is for example the local administrators group, then the owner will be SYSTEM and you will get:

Group: SYSTEM   {S-1-5-18}  
Owner: Built In Administrators: {S-1-5-32-544}  

The primary group can't be seen through the GUI Windows. To change it, you need to use SetGroup.