Hi Katrin,

You have a couple of problems with your code that I can see.

In your first call to GetNamedSecurityInfo you are ignoring the security
descriptor pointer, you can't do this. This pointer must be freed when you
are done. In your second call to GetNamedSecurityInfo you are retrieving the
security information for the Active Directory object that represents the
user, you are not retrieving information about that user. In particular, the
psd is not a pointer to that user's SID.

You need to use your original TRUSTEE code, modify the GetNamedSecurityInfo
call slightly and add code at the end to free the memory allocated for the
security descriptor. Something like this should work(not tested):

IntPtr psd = IntPtr.Zero;
IntPtr pOwner = IntPtr.Zero;
IntPtr pGroup = IntPtr.Zero;
IntPtr pDacl = IntPtr.Zero;
IntPtr pSacl = IntPtr.Zero;

int errorReturn = GetNamedSecurityInfo(entryDN,
(int)SE_OBJECT_TYPE.SE_DS_OBJECT,
DACL_SECURITY_INFORMATION,
out pOwner, out pGroup, out pDacl, out pSacl, out psd);

TRUSTEE pTrustee = new TRUSTEE();
pTrustee.pMultipleTrustee = IntPtr.Zero;
pTrustee.MultipleTrusteeOperation =
MULTIPLE_TRUSTEE_OPERATION.NO_MULTIPLE_TRUSTEE;
pTrustee.TrusteeForm = TRUSTEE_FORM.TRUSTEE_IS_NAME;
pTrustee.TrusteeType = TRUSTEE_TYPE.TRUSTEE_IS_USER;
pTrustee.strName = userDN;

uint pAccessRights;
uint result = GetEffectiveRightsFromAcl(pDacl, ref pTrustee, out
pAccessRights);

//The security descriptor pointer must always be freed
//when you are done with it.
System.Runtime.InteropServices.Marshal.FreeHGlobal(psd);