列出活动目录域和子域中的用户

Question

We have an AD with users in "mydomain.com" and users in "child.mydomain.com". When We try to list them, we can only find the "mydomain.com"'s users and groups, but we also need those from the child domain. How can I achieve this using C# ? Please take a look to my sample code :

context = new PrincipalContext(ContextType.Domain);
//...
var filter = new GroupPrincipal(context);
filter.IsSecurityGroup = true;
using(var searcher = new PrincipalSearcher(filter)
using(var results = searcher.FindAll())
{
    foreach(GroupPrincipal group in results)
    {
        string path = "LDAP://rootDSE";
        DirectoryEntry searchRoot = new DirectoryEntry(path);
        string configNC = searchRoot.Properties["configurationNamingContext"].Value.ToString();
        DirectoryEntry configSearchRoot = new DirectoryEntry("LDAP://" + configNC);
        DirectorySearcher configSearch = new DirectorySearcher(configSearchRoot);
        configSearch.Filter("(NETBIOSName=*)");
        configSearch.PropertiesToLoad.Add("dnsroot");
        configSearch.PropertiesToLoad.Add("ncname");
        configSearch.PropertiesToLoad.Add("NETBIOSName");
        SearchResultCollection forestPartitionList = configSearch.FindAll();
        List<Tuple<string,string>> netbiosNameList = new List<Tuple<string,string>>(forestPartitionList.Count);

        foreach(SearchResult domainPartition in forestPartitionList)
        {
            string ncname = domainPartition.Properties["ncname"][0].ToString();
            string netBIOSName = domainPartition.Properties["NETBIOSName"][0].ToString();
            netbiosNameList.Add(Tuple.Create(ncname, netBIOSName));
        }

        //...

        //Find group members
        using (var principal = GroupPrincipal.FindByIdentity(context, IdentityType.DistinguishedName, group.DistinguishedName))
        using (var members = principal.GetMembers(true))
        using (var enumerator = members.GetEnumerator())
        {
            //...
        }
    }
}

The code is not exactly written this way, I just want to show you the main calls that are made to query the AD. We can list the parent domain groups and users but not the child domain ones. If I change the initialization of my "context" variable passing the child domain IP and user/password, I can list the groups and users in it. But we want to be able to do so while being in the parent domain.

I hope you can help me. Thanks a lot!

Answer 1

You can query the global catalog .

It contains a read-only, searchable, partial representation of every object in every domain in a multidomain Active Directory forest.

The GC operates on port 3268 ( standard ldap ) and 3269 ( SSL ldap ). Simply connect to any of your domain controllers on one of the above two ports and your search will be automatically directed to the GC server.

To perform any modifications, though, you will have to send such request to a domain controller for that particular domain the object belongs to.