Desktop Functions:

   Smart Device Functions:

Show Recent Changes
Subscribe (RSS)
Misc. Pages
Helpful Tools
Suggested Reading
Website TODO List
Download Visual Studio Add-In

NetLocalGroupAddMembers (netapi32)
Adds members to a local group on the current or a remote computer

C# Signature:

[DllImport("NetApi32.dll", CharSet=CharSet.Auto, SetLastError=true)]
private static extern Int32 NetLocalGroupAddMembers(
    string servername, //server name
    string groupname, //group name
    UInt32 level, //info level
    ref LOCALGROUP_MEMBERS_INFO_3 buf, //Group info structure
    UInt32 totalentries //number of entries

VB Signature:

Declare Function NetLocalGroupAddMembers Lib "netapi32.dll" (TODO) As TODO

User-Defined Types:


Alternative Managed API:

Here's some sample code that can do this using System.DirectoryServices

    private void AddDomainUserToLocalGroup( string userName,
                        string groupName, string domainName)
        string computerName = SystemInformation.ComputerName;

        string localDirEntryString = "WinNT://" + computerName + ",computer";
        DirectoryEntry localDE = new DirectoryEntry(localDirEntryString);

        string domainDirEntryString = String.Format("WinNT://{0}", domainName);
        DirectoryEntry domainDE = new DirectoryEntry(domainDirEntryString);

        DirectoryEntry user = domainDE.Children.Find(userName, "user");
        DirectoryEntry group = localDE.Children.Find(groupName, "group");

        string invokeArg = user.Path.ToString();
        group.Invoke("Add", (object)invokeArg);
        catch (DirectoryServicesCOMException e)
        //trace the error
        catch (TargetInvocationException tie)
        //trace the error



Tips & Tricks:

Please add some!

Sample Code:

    using System;
    using System.Text;
    using System.Runtime.InteropServices;

    namespace ConsoleApplication3

    class Program
    [DllImport("advapi32.dll", CharSet = CharSet.Auto, SetLastError = true)]
    static extern bool LookupAccountSid(
        string SystemName,
        [MarshalAs(UnmanagedType.LPArray)] byte[] Sid,
        StringBuilder Name,
        ref uint NameCount,
        StringBuilder ReferencedDomainName,
        ref uint ReferencedDomainNameCount,
        out SID_NAME_USE SIDUse);

    [DllImport("netapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
    extern static int NetLocalGroupAddMembers(string ServerName, string LocalGroupName,
        uint Level, ref LOCALGROUP_MEMBERS_INFO_3 MemberInfo, uint TotalEntries);

    //Error codes associated with 'NetLocalGroupAddMembers'
    //The local group specified by the groupname parameter does not exist.
    private const int NERR_GroupNotFound = 2220;    
    //The user does not have access to the requested information.
    private const int ERROR_ACCESS_DENIED = 5;
    // One or more of the members specified do not exist. Therefore, no new members were added.
    private const int ERROR_NO_SUCH_MEMBER = 1387;
    // One or more of the members specified were already members of the local group. No new members were added.
    private const int ERROR_MEMBER_IN_ALIAS = 1378;
    // One or more of the members cannot be added because their account type is invalid. No new members were added.
    private const int ERROR_INVALID_MEMBER = 1388;

        public string Domain;

    private struct LOCALGROUP_MEMBERS_INFO_0
        public IntPtr pSID;


    enum SID_NAME_USE
        SidTypeUser = 1,

    private static class Win32ErrorCodes
        internal const int NERR_Success         = 0x000;
        // Member alread in group.
        internal const int MemberInAlias        = 0x562;

    static void Main(string[] args)

    static bool MakeUserAdmin(string UserName)
        bool bOk = false;

        StringBuilder sbName = new StringBuilder();
        uint uiName = (uint)sbName.Capacity;
        StringBuilder sbReferencedDomainName = new StringBuilder();
        uint uiReferencedDomainNameCount = (uint)sbReferencedDomainName.Capacity;
        SID_NAME_USE eUse;
        // Sid for BUILTIN\Administrators
        byte[] baSid = new byte[] { 1, 2, 0, 0, 0, 0, 0, 5, 32, 0, 0, 0, 32, 2 };

        if (!LookupAccountSid(null, baSid, sbName, ref uiName, sbReferencedDomainName, ref uiReferencedDomainNameCount, out eUse))
        return bOk;

        // prepare user name
        info.Domain = UserName;

        int iRetVal = 0;

        // add the user to the administrators group
        if ((iRetVal = NetLocalGroupAddMembers(null, sbName.ToString(), 3, ref info, 1)) != 0)
        return bOk;

        bOk = true;

        return bOk;

    public static void AddMemberToLocalGroup(string groupName, SecurityIdentifier sid)
        var sidBytes = new byte[sid.BinaryLength];
        sid.GetBinaryForm(sidBytes, 0);

        var info3 = new LOCALGROUP_MEMBERS_INFO_0
            pSID = Marshal.AllocHGlobal(sidBytes.Length)

            Marshal.Copy(sidBytes, 0, info3.pSID, sidBytes.Length);

            var result = NetLocalGroupAddMembers(null, groupName, 0, ref info3, 1);
            if (result == Win32ErrorCodes.NERR_Success || result == Win32ErrorCodes.MemberInAlias)

            throw new Win32Exception(result);


Please edit this page!

Do you have...

  • helpful tips or sample code to share for using this API in managed code?
  • corrections to the existing content?
  • variations of the signature you want to share?
  • additional languages you want to include?

Select "Edit This Page" on the right hand toolbar and edit it! Or add new pages containing supporting types needed for this API (structures, delegates, and more).

Access directly from VS:
Terms of Use
Edit This Page
Find References
Show Printable Version