使用LDAP啟用/禁用AD用戶

Question

是否可以使用LDAP命令在Active Directory中啟用（或禁用）用戶？

而且，是否可以用C＃做​​到這一點？

我已經看過這里和這里

謝謝，

Ĵ

Answer 1

您可以使用PrincipalContext啟用/禁用AD帳戶。 要啟用廣告，您可以執行以下操作：

 private static void EnableADUserUsingUserPrincipal(string username)
     {
       try
    {                
        PrincipalContext principalContext = new PrincipalContext(ContextType.Domain);

        UserPrincipal userPrincipal = UserPrincipal.FindByIdentity
                (principalContext, username);

        userPrincipal.Enabled = true;

        userPrincipal.Save();

    }
    catch (Exception ex)
    {
        Console.WriteLine(ex.Message);
    }
 }

要禁用Active Directory，您只需設置userPrincipal.Enabled = false;。

Answer 2

使用此參考方法：（幾乎）通過C＃在Active Directory中進行所有操作

您可以使用“ userAccountControl ”屬性來啟用和禁用

您需要將DirectoryEntry傳遞給函數

啟用：

public static void Enable(DirectoryEntry user)
    {
        try
        {
            int val = (int)user.Properties["userAccountControl"].Value;
            user.Properties["userAccountControl"].Value = val & ~0x2;
            //ADS_UF_NORMAL_ACCOUNT;

            user.CommitChanges();
            user.Close();
        }
        catch (System.DirectoryServices.DirectoryServicesCOMException E)
        {
            //DoSomethingWith --> E.Message.ToString();

        }
    }

---

禁用：

public void Disable(DirectoryEntry user)
{
    try
    {
        int val = (int)user.Properties["userAccountControl"].Value;
        user.Properties["userAccountControl"].Value = val | 0x2; 
             //ADS_UF_ACCOUNTDISABLE;

        user.CommitChanges();
        user.Close();
    }
    catch (System.DirectoryServices.DirectoryServicesCOMException E)
    {
        //DoSomethingWith --> E.Message.ToString();

    }
}

Answer 3

使用： 摩根技術空間作為參考：

使用C＃通過userAccountControl啟用Active Directory用戶帳戶

private static void EnableADUserUsingUserAccountControl(string username)
 {
    try
    {
        DirectoryEntry domainEntry = Domain.GetCurrentDomain().GetDirectoryEntry();
        // ldap filter
        string searchFilter = string.Format(@"(&(objectCategory=person)(objectClass=user)
                (!sAMAccountType=805306370)(|(userPrincipalName={0})(sAMAccountName={0})))", username);

        DirectorySearcher searcher = new DirectorySearcher(domainEntry, searchFilter);
        SearchResult searchResult = searcher.FindOne();
        if (searcher != null)
        {
            DirectoryEntry userEntry = searchResult.GetDirectoryEntry();

            int old_UAC=(int)userEntry.Properties["userAccountControl"][0];

            // AD user account disable flag
            int ADS_UF_ACCOUNTDISABLE = 2;

            // To enable an ad user account, we need to clear the disable bit/flag:
            userEntry.Properties["userAccountControl"][0] = (old_UAC & ~ADS_UF_ACCOUNTDISABLE);
            userEntry.CommitChanges();

            Console.WriteLine("Active Director User Account Enabled successfully 
                                      through userAccountControl property");
        }
        else
        {
            //AD User Not Found
        }
    }
    catch (Exception ex)
    {
        Console.WriteLine(ex.Message);
    }
}

使用C＃通過userAccountControl禁用Active Directory用戶帳戶

private static void DisableADUserUsingUserAccountControl(string username)
{
    try
    {
        DirectoryEntry domainEntry = Domain.GetCurrentDomain().GetDirectoryEntry();
        // ldap filter
        string searchFilter = string.Format(@"(&(objectCategory=person)(objectClass=user)
              (!sAMAccountType=805306370)(|(userPrincipalName={0})(sAMAccountName={0})))", username);

        DirectorySearcher searcher = new DirectorySearcher(domainEntry, searchFilter);
        SearchResult searchResult = searcher.FindOne();
        if (searcher != null)
        {
            DirectoryEntry userEntry = searchResult.GetDirectoryEntry();

            int old_UAC = (int)userEntry.Properties["userAccountControl"][0];

            // AD user account disable flag
            int ADS_UF_ACCOUNTDISABLE = 2;

            // To disable an ad user account, we need to set the disable bit/flag:
            userEntry.Properties["userAccountControl"][0] = (old_UAC | ADS_UF_ACCOUNTDISABLE);
            userEntry.CommitChanges();

            Console.WriteLine("Active Director User Account Disabled successfully 
                                through userAccountControl property");
        }
        else
        {
            //AD User Not Found
        }
    }
    catch (Exception ex)
    {
        Console.WriteLine(ex.Message);
    }
}

使用C＃通過UserPrincipal啟用AD用戶帳戶

private static void EnableADUserUsingUserPrincipal(string username)
{
    try
    {                
        PrincipalContext principalContext = new PrincipalContext(ContextType.Domain);

        UserPrincipal userPrincipal = UserPrincipal.FindByIdentity
                (principalContext, username);

        userPrincipal.Enabled = true;

        userPrincipal.Save();

        Console.WriteLine("Active Director User Account Enabled successfully through UserPrincipal");
    }
    catch (Exception ex)
    {
        Console.WriteLine(ex.Message);
    }
}

使用C＃通過UserPrincipal禁用AD用戶帳戶

private static void DiableADUserUsingUserPrincipal(string username)
{
    try
    {
        // To use this class, you need add reference System.DirectoryServices.AccountManagement which 

僅可從.NET 3.5獲得； PrincipalContextPrincipalContext =新的PrincipalContext（ContextType.Domain）;

        UserPrincipal userPrincipal = UserPrincipal.FindByIdentity
                (principalContext, username);

        userPrincipal.Enabled = false;

        userPrincipal.Save();

        Console.WriteLine("Active Director User Account Disabled successfully through UserPrincipal");
    }
    catch (Exception ex)
    {
        Console.WriteLine(ex.Message);
    }
}