使用C#操作WindowAD之Windows用户

.net对ladp操作windowsAD的一些类和接口，都放在System.DirectoryServices命名空间下面。

 

public void CreateWindowsUser(String userName,String password,String userDesc,int userControl)
{
     String ladpRootPath = "LDAP://192.168.213.168/CN=Users,DC=pk1,DC=cctv,DC=com";
     DirectoryEntry ladpRoot = new DirectoryEntry(ladpRootPath);
     ladpRoot.Username = "XXXXX";
     ladpRoot.Password = "XXXXX";
     DirectoryEntry user = ladpRoot.Children.Add("CN="+ userName, "user");
     user.Properties["sAMAccountName"].Value = userName;
     user.Properties["description"].Value = userDesc;
     user.Properties["userAccountControl"].Value = userControl;
     user.CommitChanges();
     user.Invoke("SetPassword", password);
     user.CommitChanges();
     user.Close();
}

 

上述方法简单实现了添加一个Windows用户，值得注意的是如果你的程序是放在域控上面执行的，那么 ladpRoot.Username和ladpRoot.Password就不能赋值。另外ladpRootPath是ladp的路径写法，LDAP://192.168.213.168表示你要操作的主机地址， DC=pk1,DC=cctv,DC=com表示要操作的Windows域，CN=Users表示在windows域的主目录下的Users容器对象。方法参数userControl表示一些用户属性，如密码永不过期，禁用用户等等，具体的值，详见http://support.microsoft.com/kb/305144/zh-cn，如果用户包含多个属性，则将这些属性值做按位或(|)的运算即可。在这些用户属性中，有一个比较例外，那就是PASSWD_CANT_CHANGE，此属性表示用户不能修改密码，但是他是一个只读的属性，也就是说不能通过设置userAccountControl来实现功能，如果要实现此功能，那么必须在上述代码 user.Close();之前插入如下代码：

 

 Guid changePasswordGuid = new Guid("{ab721a53-1e2f-11d0-9819-00aa0040529b}");
 IdentityReference selfSddl = new SecurityIdentifier(WellKnownSidType.SelfSid, null); 
 IdentityReference everyoneSddl = new SecurityIdentifier(WellKnownSidType.WorldSid, null); 
 ActiveDirectoryAccessRule selfAccRule = new ActiveDirectoryAccessRule(selfSddl, ActiveDirectoryRights.ExtendedRight, AccessControlType.Deny, changePasswordGuid);
 ActiveDirectoryAccessRule everyoneAccRule = new ActiveDirectoryAccessRule(everyoneSddl, ActiveDirectoryRights.ExtendedRight, AccessControlType.Deny, changePasswordGuid);
 user.ObjectSecurity.AddAccessRule(selfAccRule);
 user.ObjectSecurity.AddAccessRule(everyoneAccRule);
 user.CommitChanges();

 

下面给出一些常用的用户操作代码：

 

修改用户：

 

public void ModifyWindowsUser(String userName,String password,String userDesc,int userControl)
{
     String ladpRootPath = "LDAP://192.168.213.168/CN=Users,DC=pk1,DC=cctv,DC=com";
     DirectoryEntry ladpRoot = new DirectoryEntry(ladpRootPath);
     ladpRoot.Username = "XXXXX";
     ladpRoot.Password = "XXXXX";
     DirectoryEntry user = ladpRoot.Children.Find("CN=" +userName, "user");
     user.Properties["description"].Value = userDesc;
     user.Properties["userAccountControl"].Value = userControl;
     user.CommitChanges();
     user.Invoke("SetPassword", password);
     user.CommitChanges();
     user.Close();
}

 

 

删除用户

 

 

public void DeleteWindowsUser(String userName)
{
     String ladpRootPath = "LDAP://192.168.213.168/CN=Users,DC=pk1,DC=cctv,DC=com";
     DirectoryEntry ladpRoot = new DirectoryEntry(ladpRootPath);
     ladpRoot.Username = "XXXXX";
     ladpRoot.Password = "XXXXX";
     DirectoryEntry user = ladpRoot.Children.Find("CN=" +userName, "user");
     user.DeleteTree();
     user.Close();
}