如何在C＃中创建属于Domain Admins组的AD用户

Question

I'm working on a C# project which auto-creates new Active Directory users and let them access to the AD server.

I have made a general user with the following code, but since the user does not belong to Domain Admins, it could not access to the server.

Domain domain = Domain.GetCurrentDomain();
PrincipalContext context = new PrincipalContext(ContextType.Domain);

UserPrincipal principal = new UserPrincipal(context);
principal.Name = name;
principal.UserPrincipalName = name + "@" + domain.Name;
principal.SamAccountName = name;
principal.Enabled = true;
principal.SetPassword(password);
principal.PasswordNeverExpires = true;
principal.Save();

Is there a way to include which group the new user belong in the code? Or after creating the account, adding the user to Domain Admins group might be another solution but I couldn't figure out how to do this either. Any advice would be appreciated.

Answer 1

You just need to find the group and add the user you created. Like this:

var group = GroupPrincipal.FindByIdentity(context, "Domain Admins");
group.Members.Add(principal);
group.Save();

The code will have to run with credentials that can add someone to the Domain Admins group, which is likely a domain admin account itself.