Hi

First of all, I would like to say that the tool whoami and the IsInRole
method will works in my side when logon as a common user. So I guess that
your account did not have the rights to query the AD information about the
group and that's why I suggest you use the domain admin, I just wants to
isolate the problem that we need to firstly ensure the code is fine.

We also try to use the ADSI code to do the job. But as the whoami tool did
not work for you, so I think the code below may not work properly. I have
tested the code on my side which works fine for a common domain users
account.

NOTE: Because the whoami
The IsMember function will work for common group, except the primary group.
e.g. the Domain Users is the primary group, we need to use another approach
to handle such case, use GetPrimaryGroup to get the primary group to see
certain user's primary and do the string match to get the result.

        private void button2_Click(object sender, System.EventArgs e)
        {
            string groupPath = "LDAP://CN=Test Group,CN=Users,DC=D1,DC=D2,DC=D3";
            string userPath = "LDAP://CN=Peter Huang,CN=Users,DC=D1,DC=D2,DC=D3";
            DirectoryEntry user = new DirectoryEntry(userPath);
            MessageBox.Show(GetPrimaryGroup(user));
            DirectoryEntry group = new DirectoryEntry(groupPath);
            if(true == (bool)group.Invoke("IsMember", new string[]{userPath}))
            {
                MessageBox.Show("User is in group");
            }
            else
            {
                MessageBox.Show("User is NOT in group");
            }
        }
        private string GetPrimaryGroup(DirectoryEntry aEntry)
        {
            int primaryGroupID = (int)aEntry.Properties["primaryGroupID"].Value;
            byte[] objectSid = (byte[])aEntry.Properties["objectSid"].Value;

            StringBuilder escapedGroupSid = new StringBuilder();

            // Copy over everything but the last four bytes(sub-authority)
            // Doing so gives us the RID of the domain
            for(uint i = 0; i < objectSid.Length - 4; i++)
            {
                escapedGroupSid.AppendFormat("\\{0:x2}", objectSid[i]);
            }

            //Add the primaryGroupID to the escape string to build the
            // SID of the primaryGroup
            for(uint i = 0; i < 4; i++)
            {
                escapedGroupSid.AppendFormat("\\{0:x2}",
                    (primaryGroupID & 0xFF));
                primaryGroupID >>= 8;
            }

            //Search the directory for a group with this SID
            DirectorySearcher searcher = new DirectorySearcher();
 
            searcher.Filter = "(&(objectCategory=Group)(objectSID=" +
                escapedGroupSid.ToString() + "))";
 
            searcher.PropertiesToLoad.Add("distinguishedName");
 
            return
                searcher.FindOne().Properties["distinguishedName"][0].ToString();
        }

Hope this helps.

Best regards,

Perter Huang
Microsoft Online Partner Support

The solution (thanks to Peter) is to switch the computer from the domain to a
workgroup and then back to the domain. Then it works. No idea why.

thanks - dave