Creating Groups
| http://msdn.microsoft.com/library/default.asp?url=/library/en-us/sds/sds/creating_groups.asp When you create a new group, you can use flags from the ADS_GROUP_TYPE_ENUM enumeration to assign a group type to the group, such as global (ADS_GROUP_TYPE_GLOBAL_GROUP), domain local (ADS_GROUP_TYPE_DOMAIN_LOCAL_GROUP), local (ADS_GROUP_TYPE_LOCAL_GROUP), universal (ADS_GROUP_TYPE_UNIVERSAL_GROUP) or security enabled (ADS_GROUP_TYPE_SECURITY_ENABLED). If you do not specify a group type, the default is to create a global, secured group (ActiveDs.ADS_GROUP_TYPE_ENUM.ADS_GROUP_TYPE_GLOBAL_GROUP | ActiveDs.ADS_GROUP_TYPE_ENUM.ADS_GROUP_TYPE_SECURITY_ENABLED). The following code example shows how to create a new group, called Practice Managers to the organizational unit, called Consulting. DirectoryEntry dom = new DirectoryEntry(); // Bind to the domain that this user is currently connected to. The following code example shows how to create a local domain group called Managers to the Consulting organizational unit. Use COM Interop to specify the ADS_GROUP_TYPE_DOMAIN_LOCAL_GROUP flag. DirectoryEntry dom = new DirectoryEntry(); The following code example shows how create a non-security group, which is a distribution list called Full Time Employees to the Consulting organizational unit. Use COM Interop to specify the ADS_GROUP_TYPE_GLOBAL_GROUP flag. DirectoryEntry dom = new DirectoryEntry(); The following code example shows how to add an entire group to another group. DirectoryEntry dom = new DirectoryEntry(); Adding Users to a GroupWhen a group is created, users must be added to the group. The following code example shows how to add a user, new user, to the consulting organization. DirectoryEntry dom = new DirectoryEntry(); Dim dom As New DirectoryEntry() Removing Users from a GroupThe following code example shows how to remove users from a group. For this task, find the user to be removed, which in the example is User Name, then call the Remove method. DirectoryEntry dom = new DirectoryEntry(); DirectoryEntries.Remove Method http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpref/html/frlrfSystemDirectoryServicesDirectoryEntriesClassRemoveTopic.asp?frame=true The following example creates a new DirectoryEntry with the specified path, then creates a new entry in the container and saves it. Finally, it retrieves the newly created entry and deletes it. Enumerating Users in a GroupThis topic includes code examples for enumerating the members of a group. If the group has many members, you can get a result set by calling IADsGroup::Members. The following code example shows how to get members using the SearchResult property Properties. DirectoryEntry group = new DirectoryEntry("LDAP://CN=Sales,DC=Fabrikam,DC=COM"); The following code example shows how to get members using the Invoke method to call the ADSI IADsGroup::Members method. DirectoryEntry group = new DirectoryEntry("LDAP://CN=Sales,DC=Fabrikam,DC=COM"); Enumerating Members in a Large GroupThis topic explains how range retrieval works and provides several code examples for using range retrieval to obtain the members of a group. The group object contains a property called member which contains multiple values in an array. Because group memberships can sometimes be quite large, this property may contain hundreds of values. Range retrieval is a process of obtaining a portion of the members at a time. For Windows Server 2003 family, the maximum number of values that can be retrieved from the server at one time is 1500. If you set the range retrieval to a value that is higher than the number of values in the set, the search fails. If you set the range to a small number, then you can degrade the performance of the search because it must return to the server for new results more often. For more information about range retrieval, see Enumerating Groups That Contain Many Members. The following code example shows how to get members of a group using range retrieval. This sample retrieves entries 0-500, inclusively. The maximum entries for this result set are 5001. You can also use range retrieval to retrieve a portion of the result set by starting and ending at a specified point within the result set. To do this, modify the {"member;Range=0-500"} statement. For example, to retrieve the third and fourth entries in the result set, you would use the statement {"member;Range=2-3"}. To retrieve all entries, starting with 502 to the end of the result set, you would use the statement {"member;Range=501-*"}. The final code example shows how to use range retrieval to get all the members of the group when you do not know how many members are in the group. Because range retrieval does not work if you try to get more members than are in the result set, this code example tests for a failure and when it receives it, it changes the range statement to ("member;range={0}-*", rangeLow) to enumerate the final members in the set. Searching for GroupsThis topic shows how to search for groups using DirectorySearcher. The following code example shows how to search for all groups on a domain. using System.DirectoryServices; The following code example shows how to search for all security enabled groups. For this search, use COM Interop. It uses a bitwise search. using System.DirectoryServices; The following code example shows how to search for all global domain groups, regardless of whether they are secure or non-secure. For this search, use COM Interop. using System.DirectoryServices; The following code example shows how to search for all global domain, secure groups. For this search, use COM Interop. using System.DirectoryServices; Deleting GroupsThe following code example shows how to delete a group using the DirectoryEntries method called Remove. For this task, find the group to delete, which, in the example, is Consulting, then run the Remove method. 'Bind to the current domain.
Dim dom As New DirectoryEntry()
'Use the Find method to find the Consulting OU
Dim ou As DirectoryEntry = dom.Children.Find("OU=Consulting")
'To delete a group, bind to the group within the OU
Dim group As New DirectoryEntry(ou + "CN=groupname")
'To delete a manager, bind to the manager object within the OU
Dim mgr As New DirectoryEntry(ou + "CN=mgrname")
'To delete a distribution list, bind to the distribution list object
'within the OU
Dim dl As New DirectoryEntry(ou + "CN=dlname")
'Use the remove method to remove each of these objects.
ou.Children.Remove(group)
ou.Children.Remove(mgr)
ou.Children.Remove(dl)
User Managementhttp://msdn.microsoft.com/library/default.asp?url=/library/en-us/sds/sds/creating_groups.asp For more information about properties that can be set on the user object during creation, see Creating a User. The following topics are provided in this section:
The following code example shows how to create a user in an organizational unit. By default, this account will be disabled. To enable the account, set a password for it. For more information, see Managing User Passwords. Creating UsersDirectoryEntry ent = new DirectoryEntry();
DirectoryEntry ou = ent.Children.Find("OU=Consulting");
// Use the Add method to add a user in an organizational unit.
DirectoryEntry usr = ou.Children.Add("CN=New User","user");
// Set the samAccountName, then commit changes to the directory.
usr.Properties["samAccountName"].Value = "newuser";
usr.CommitChanges();
The samAccountName property is set in this code example. The samAccountName creates a unique samAccountName, such as $CP2000-O16B1V0UKHK7. This property is required on the user account when the domain controller is running on a Windows NT 4.0 server. In Windows Server 2003, the samAccountName property is optional. This topic provides code examples for enabling and disabling a user account. It uses the Properties method to access the userAccountControl property to set the ADS_UF_ACCOUNTDISABLE flag which is defined in the ADS_USER_FLAG_ENUM. Enabling and Disabling the User AccountThe following code example shows how to enable a user account. DirectoryEntry usr = new DirectoryEntry("LDAP://CN=New User,CN=users,DC=fabrikam,DC=com");
int val = (int) usr.Properties["userAccountControl"].Value;
usr.Properties["userAccountControl"].Value = val & ~ADS_UF_ACCOUNTDISABLE;
usr.CommitChanges();
The following code example shows how to disable a user account. DirectoryEntry usr = new DirectoryEntry("LDAP://CN=Old User,CN=users,DC=fabrikam,DC=com");
int val = (int) usr.Properties["userAccountControl"].Value;
usr.Properties["userAccountControl"].Value = val | ADS_UF_ACCOUNTDISABLE;
usr.CommitChanges();
Setting a User Account ExpirationThis code example shows how to set the expiration on a user account. This operation uses the InvokeMember method to access the IADsUser property AccountExpirationDate. using System.Reflection;
...
Type type = usr.NativeObject.GetType();
Object adsNative = usr.NativeObject;
type.InvokeMember("AccountExpirationDate", BindingFlags.SetProperty, null,
adsNative, new object[]{"12/29/2004"});
usr.CommitChanges();
Managing User PasswordsThe following code example shows how to set the user password by invoking the IADsUser::SetPassword method. usr.Invoke("SetPassword", new object[]{"secret"});
The following code example shows how to change the user password by invoking the IADsUser::ChangePassword method. usr.Invoke("ChangePassword",new object[]{"oldpass","newpass"});
The following code example shows how to set the user password so that it must be changed at the next logon. It sets the pwdLastSet property to off (-1). usr.Properties["pwdLastSet"].Value = -1; // To turn on, set this value to 0. usr.CommitChanges(); The following code example shows a function that sets an ACE to deny a password change. It uses COM Interop to access the IADsSecurityDescriptor to get the ntSecurityDescriptor property. It then uses the IADsAccessControlList to get the DACL from the security descriptor and IADsAccessControlEntry to get the AceType, AceFlags, Trustee, Flags, ObjectType and AccessMask properties. The AceType flags are defined in ADS_ACETYPE_ENUM. The AceFlags are defined in the ADS_FLAGTYPE_ENUM. AccessMask flags are defined in the ADS_RIGHTS_ENUM. Imports System
Imports System.DirectoryServices
Imports ActiveDs
...
Shared Sub DenyChangePassword(User As DirectoryEntry)
Const PASSWORD_GUID As String = "{ab721a53-1e2f-11d0-9819-00aa0040529b}"
Const ADS_UF_ACCOUNTDISABLE As Integer = 2
Const ADS_UF_PASSWORD_EXPIRED As Integer = &H800000
Const ADS_UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION As Integer = &H1000000
Dim trustees() As String = {"NT AUTHORITY\SELF", "EVERYONE"}
Dim sd As ActiveDs.IADsSecurityDescriptor = CType(User.Properties("ntSecurityDescriptor").Value,
ActiveDs.IADsSecurityDescriptor)
Dim acl As ActiveDs.IADsAccessControlList = CType(sd.DiscretionaryAcl,
ActiveDs.IADsAccessControlList)
Dim ace As New ActiveDs.AccessControlEntry()
Dim trustee As String
For Each trustee In trustees
ace.Trustee = trustee
ace.AceFlags = 0
ace.AceType = Fix(ActiveDs.ADS_ACETYPE_ENUM.ADS_ACETYPE_ACCESS_DENIED_OBJECT)
ace.Flags = Fix(ActiveDs.ADS_FLAGTYPE_ENUM.ADS_FLAG_OBJECT_TYPE_PRESENT)
ace.ObjectType = PASSWORD_GUID
ace.AccessMask = Fix(ActiveDs.ADS_RIGHTS_ENUM.ADS_RIGHT_DS_CONTROL_ACCESS)
acl.AddAce(ace)
Next trustee
sd.DiscretionaryAcl = acl
User.Properties("ntSecurityDescriptor").Value = sd
User.CommitChanges()
End Sub 'DenyChangePasswordusing System;
using System.DirectoryServices;
using ActiveDs;
...
static void DenyChangePassword(DirectoryEntry User)
{
const string PASSWORD_GUID = "{ab721a53-1e2f-11d0-9819-00aa0040529b}";
const int ADS_UF_ACCOUNTDISABLE=2;
const int ADS_UF_PASSWORD_EXPIRED=0x800000;
const int ADS_UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION=0x1000000;
string[] trustees = new string[]{@"NT AUTHORITY\SELF","EVERYONE"};
ActiveDs.IADsSecurityDescriptor sd = (ActiveDs.IADsSecurityDescriptor)
User.Properties["ntSecurityDescriptor"].Value;
ActiveDs.IADsAccessControlList acl = (ActiveDs.IADsAccessControlList) sd.DiscretionaryAcl;
ActiveDs.IADsAccessControlEntry ace = new ActiveDs.AccessControlEntry();
foreach(string trustee in trustees)
{
ace.Trustee = trustee;
ace.AceFlags = 0;
ace.AceType = (int)ActiveDs.ADS_ACETYPE_ENUM.ADS_ACETYPE_ACCESS_DENIED_OBJECT;
ace.Flags = (int)ActiveDs.ADS_FLAGTYPE_ENUM.ADS_FLAG_OBJECT_TYPE_PRESENT;
ace.ObjectType = PASSWORD_GUID;
ace.AccessMask = (int)ActiveDs.ADS_RIGHTS_ENUM.ADS_RIGHT_DS_CONTROL_ACCESS;
acl.AddAce(ace);
}
sd.DiscretionaryAcl = acl;
User.Properties["ntSecurityDescriptor"].Value = sd;
User.CommitChanges();
}
The following code example shows how to set the password to never expire. It uses the Properties method to access the userAccountControl property to set the ADS_UF_DONT_EXPIRE_PASSWD flag defined in the ADS_USER_FLAG_ENUM. Shared Sub DontExpirePassword(User As DirectoryEntry)
Dim val As Integer
Const ADS_UF_DONT_EXPIRE_PASSWD As Integer = &H10000
val = Fix(User.Properties("userAccountControl").Value)
User.Properties("userAccountControl").Value = val Or ADS_UF_DONT_EXPIRE_PASSWD
User.CommitChanges()
End Sub 'DontExpirePasswordusing System;
using System.DirectoryServices;
using ActiveDs;
...
static void DontExpirePassword(DirectoryEntry User)
{
int val;
const int ADS_UF_DONT_EXPIRE_PASSWD =0x10000;
val = (int) User.Properties["userAccountControl"].Value;
User.Properties["userAccountControl"].Value = val |
ADS_UF_DONT_EXPIRE_PASSWD;
User.CommitChanges();
}
Setting User Account FlagsThis topic contains code examples that set various user flags. It uses the Properties method to access the userAccountControl property to set flags defined in the ADS_USER_FLAG_ENUM. The following code example shows how to require that a SmartCard be used for an interactive logon. val= (int) usr.Properties["userAccountControl"].Value; usr.Properties["userAccountControl"].Value = val | ADS_UF_SMARTCARD_REQUIRED; usr.CommitChanges(); The following code example shows how to set the account to use a DES encryption type. const int ADS_UF_USE_DES_KEY_ONLY=0x200000; val= (int) usr.Properties["userAccountControl"].Value; usr.Properties["userAccountControl"].Value = val | ADS_UF_USE_DES_KEY_ONLY; usr.CommitChanges(); The following code example shows how to set the account so that it is trusted for delegation. const int ADS_UF_TRUSTED_FOR_DELEGATION =0x80000; val= (int) usr.Properties["userAccountControl"].Value; usr.Properties["userAccountControl"].Value = val | ADS_UF_TRUSTED_FOR_DELEGATION; usr.CommitChanges(); The following code example shows how to show that the account is sensitive and cannot be used for delegation. const int ADS_UF_NOT_DELEGATED=0x100000; val= (int) usr.Properties["userAccountControl"].Value; usr.Properties["userAccountControl"].Value = val | ADS_UF_NOT_DELEGATED; usr.CommitChanges(); The following code example shows how to set the account so that it does not require Kerberos pre-authentication. const int ADS_UF_DONT_REQUIRE_PREAUTH=0x400000; val= (int) usr.Properties["userAccountControl"].Value; usr.Properties["userAccountControl"].Value = val | ADS_UF_DONT_REQUIRE_PREAUTH; usr.CommitChanges(); Setting Properties Displayed on Property PagesThis topic provides code examples for setting the properties that appear in the property pages for users, which is accessed through the Active Directory Users and Computers MMC snap-in. If you have not used this snap-in before, you can open it on the server by selecting Start>All Programs>Administrative Tools>Active Directory Users and Computers. In the Users folder, right-click on a user name and select Properties. If you are setting up an application that allows a user to change information such as a home address, this is a useful piece of code to add to your application. The following code example shows how to set common properties displayed in the General page. usr.Properties["givenName"].Value = "New User";
usr.Properties["initials"].Value = "Ms";
usr.Properties["sn"].Value = "Name";
usr.Properties["displayName"].Value = "New User Name";
usr.Properties["description"].Value = "Vice President-Operation";
usr.Properties["physicalDeliveryOfficeName"].Value = "40/5802";
usr.Properties["telephoneNumber"].Value = "(425)222-9999";
usr.Properties["mail"].Value = "newuser@fabrikam.com";
usr.Properties["wWWHomePage"].Value = "http://www.fabrikam.com/newuser";
usr.Properties["otherTelephone"].AddRange(new
string[]{"(425)111-2222","(206)222-5263"});
usr.Properties["url"].AddRange(new
string[]{"http://newuser.fabrikam.com","http://www.fabrikam.com/officers"});
usr.CommitChanges();
The following code example shows how to set common properties displayed in the Address page. usr.Properties["streetAddress"].Value = "2050 Fabrikam Way NE"; usr.Properties["postOfficeBox"].Value = "S/2523"; usr.Properties["l"].Value = "Sammamish"; usr.Properties["st"].Value = "Washington"; usr.Properties["postalCode"].Value = "98074"; usr.Properties["c"].Value = "US"; usr.CommitChanges(); The following code example shows how to set common properties displayed in the Account page. usr.Properties["userPrincipalName"].Value = "newuser@fabrikam.com"; usr.Properties["sAMAccountName"].Value = "newuser"; usr.Properties["userWorkstations"].Value = "wrkst01,wrkst02,wrkst03"; usr.CommitChanges(); Enumerating User MembershipsThis topic includes information and a code example that shows how to use a Windows form to enumerate user memberships To create a Windows form to display user memberships
The following code example shows how to use a Windows form to enumerate user memberships. static void Main()
{
Application.Run(new Form1());
}
private void label1_Click(object sender, System.EventArgs e)
{
}
private void textBox1_TextChanged(object sender, System.EventArgs e)
{
}
private void button1_Click(object sender, System.EventArgs e)
{
string strUserADsPath = "LDAP://fabrikam/cn=" +textBox1.Text +",cn=users,dc=fabrikam,dc=com";
DirectoryEntry oUser;
oUser = new DirectoryEntry(strUserADsPath);
listBox1.Items.Add("Groups to which {0} belongs:"+ oUser.Name);
// Invoke IADsUser::Groups method.
object groups = oUser.Invoke("Groups");
foreach ( object group in (IEnumerable)groups)
{
// Get the Directory Entry.
DirectoryEntry groupEntry = new DirectoryEntry(group);
listBox1.Items.Add(groupEntry.Name);
}
}
private void Form1_Load(object sender, System.EventArgs e)
{
}
}
System.DirectoryServices Referencehttp://msdn.microsoft.com/library/default.asp?url=/library/en-us/sds/sds/creating_groups.asp The classes in this namespace can be used with any of the Active Directory service providers. The current providers are: Internet Information Services (IIS), Lightweight Directory Access Protocol (LDAP), Novell NetWare Directory Service (NDS), and WinNT. ADSI is a programmatic interface for Microsoft Active Directory that enables your applications to interact with diverse directories on a network, using a single interface. Using ADSI, you can create applications that can perform common tasks, such as backing up databases, accessing printers, and administering user accounts. It is assumed that you have a general understanding of Active Directory before using these classes. Active Directory is a tree structure. Each node in the tree contains a set of properties. Use this namespace to traverse, search, and modify the tree, and read and write to the properties of a node. The DirectoryEntry class encapsulates a node or object in the Active Directory hierarchy. Use this class for binding to objects, reading properties, and updating attributes. Together with helper classes, DirectoryEntry provides support for life-cycle management and navigation methods, including creating, deleting, renaming, moving a child node, and enumerating children. Use the DirectorySearcher class to perform queries against the Active Directory hierarchy. LDAP is the only system-supplied Active Directory Service Interfaces (ADSI) provider that supports searching. A search of the Active Directory hierarchy through DirectorySearcher returns instances of SearchResult, which are contained in an instance of the SearchResultCollection class. |
'Programming > Dot.NET' 카테고리의 다른 글
| Visual Basic.NET으로 다중 스레드 프로그래밍 (1) | 2013.07.31 |
|---|---|
| 외부프로그램 실행 및 출력화면 가져오기 (0) | 2010.10.07 |
| IE에서 닷넷 스마트 클라이언트 개발3-스마트 클라이언트 배포하기4 (0) | 2008.02.25 |
| IE에서 닷넷 스마트 클라이언트 개발3-스마트 클라이언트 배포하기3 (0) | 2008.02.25 |
| IE에서 닷넷 스마트 클라이언트 개발3-스마트 클라이언트 배포하기2 (0) | 2008.02.25 |