What permissions are required for enumerating users groups in Active Directory

On your domain object, you need to assign the querying user the "Read MemberOf" right to User objects.

• Open AD U&C browse to your domain object
• Right click and go to properties:
  
  
  
  
• Security tab, click Advanced
• Click Add
• Enter the user name to add
• Click the Properties tab
• In 'Apply Onto' change the type to User
• Click the "Read MemberOf" checkbox:
  
  
  
  
• OK out of there

That should set it up so that the specified account can read the group memberships of all User accounts in the domain.

I had a similar issue and solved it on another level with a request to the AD:

(&(objectClass=group)(objectClass=top)(member=UserDN))

for the "dn" attribute.

As groups are readable by default, this will return an equal result to the "membersOf" property.

I know this is not really an answer to the permission question, but i landed here searching for a way to get the memberOf property without a permission-change in AD.