为符合复杂性策略的AD用户帐户生成密码

Question

I need to create AD users automatically. The problem is, making sure the generated password meets the password policy of AD . I don't know what the policy will be, is there a way to determine that at runtime? This is what I'm using but you can see the complexity is static to length=16 and 4 non-alphanumeric chars and might not always work. I am looking for a way to get the password policy from AD so the generated passwords are correct.

UserPrincipal up = new UserPrincipal(oPrincipalContext);                        
                    up.SamAccountName = userId;
                    up.SetPassword(System.Web.Security.Membership.GeneratePassword(16, 4));                        
                    up.Enabled = false;
                    up.ExpirePasswordNow();    
                    up.Save();

Answer 1

This is what I'm using. I'm getting the password properties using DirectoryEntry/LDAP , then use those to create the password.

DirectoryEntry child = new DirectoryEntry("LDAP://machine/DC=domain,DC=com");
int minPwdLength = (int)child.Properties["minPwdLength"].Value;
int pwdProperties = (int)child.Properties["pwdProperties"].Value;

Use the properties when creating the password.

UserPrincipal up = new UserPrincipal(oPrincipalContext);                        
                up.SamAccountName = userId;
                up.SetPassword(System.Web.Security.Membership.GeneratePassword(minPwdLength,
                                   pwdProperties));                        
                up.Enabled = true;
                up.ExpirePasswordNow();    
                up.Save();