C＃以其他用户身份访问Active Directory

Question

I'd like to ask for your help with following issue. I am working on ad-hoc application, will be used only by me and just once.

Part of it is to perform password reset for over 3000 users in AD and send them new credentials.

I can read from AD as normal user, but I have to use privileged account to modify it. How can I do that? I know, I can use PowerShell and have it done in a seconds, but I'd like to learn how to do it in C#.

My code to search for user is simple

public class ADSecurity
{
    public static string getUserName(string sam)
    {
        PrincipalContext ctx = new PrincipalContext(ContextType.Domain);
        UserPrincipal user = UserPrincipal.FindByIdentity(ctx, IdentityType.SamAccountName, sam);
        return user.Name;
    }
}

How can I do the same, but as different user?

I've seen some guides, but none of them explained az ... just advice on how to impersonate, but nothing about how to use it. There was one article here about impersonation, but using LDAP protocol ( DirectoryEntry ). But as I understand, it is really slow.

Any advice appreciated. I need to run it 2 days from now, so in worst case scenario I use PowerShell to do it.

Thanks.

Answer 1

There are a few ways to do it:

1. Run your application under the needed credentials (Shift+right-click on the .exe file and use 'Run as a different user'). If you're just doing this once, this is the easiest.
2. Use the PrincipalContext constructor that accepts a username and password.

public class ADSecurity
{
    public static string getUserName(string sam)
    {
        PrincipalContext ctx = new PrincipalContext(ContextType.Domain, null, username, password);
        UserPrincipal user = UserPrincipal.FindByIdentity(ctx, IdentityType.SamAccountName, sam);
        return user.Name;
    }
}

3. Use the DirectoryEntry constructor that accepts a username and password.

I'm not sure which example you're talking about that's "slow", but in my experience, using DirectoryEntry directly is almost always faster, as long as you use it correctly. The System.DirectoryServices.AccountManagement namespace (what you are using in your example) uses DirectoryEntry behind the scenes anyway.

Of course, options 2 & 3 require you know the password.