Question

我使用下面的代码来查询AD中用户/ OU的更改。但它不会检索任何已删除的对象，不知道如何在此包含已删除的对象吗？

static void Main(string[] args)
        {
 BinaryFormatter bFormat = new BinaryFormatter();
            byte[] cookie = null;
            string strFileName = "cookie.bin";
            if (File.Exists(strFileName))
            {
                using (FileStream fsStream = new FileStream(strFileName, FileMode.OpenOrCreate))
                {
                    cookie = (byte[])bFormat.Deserialize(fsStream);
                }
            }


            string str_dcName = "xxxxx"; 
            System.DirectoryServices.DirectoryEntry rootDSE = new System.DirectoryServices.DirectoryEntry("LDAP://rootDSE");
            System.Net.NetworkCredential cr = new System.Net.NetworkCredential(@"xxx", "xxx", "xxx");
            LdapConnection connection = new LdapConnection(str_dcName);
            connection.Credential = cr;
            connection.Bind();

            string[] attribs = new string[3];
            attribs[0] = "name";
            attribs[1] = "description";
            attribs[2] = "objectGUID";

            SearchRequest request = new SearchRequest("DC=xxx,DC=xxx,DC=com", "(objectClass=*)", SearchScope.Subtree, attribs);

            DirSyncRequestControl dirSyncRC = new DirSyncRequestControl(cookie, DirectorySynchronizationOptions.IncrementalValues, Int32.MaxValue);
            request.Controls.Add(dirSyncRC);

            bool bMoreData = true;
            SearchResponse searchResponse = (SearchResponse)connection.SendRequest(request);

            while (bMoreData) //Initial Search handler - since we're unable to combine with paged search
            {
                foreach (SearchResultEntry entry in searchResponse.Entries)
                {
                    System.Collections.IDictionaryEnumerator attribEnum = entry.Attributes.GetEnumerator();
                    while (attribEnum.MoveNext())//Iterate through the result attributes
                        {
                        //Attributes have one or more values so we iterate through all the values 
                        //for each attribute
                        DirectoryAttribute subAttrib = (DirectoryAttribute)attribEnum.Value;
                        for (int ic = 0; ic < subAttrib.Count; ic++) {
                            //Attribute Name below
                            Console.WriteLine(attribEnum.Key.ToString());
                            //Attribute Sub Value below
                            Console.WriteLine(subAttrib[ic].ToString());
                        }
                    }
                }

                //Get the cookie from the response to use it in next searches


                foreach (DirectoryControl control in searchResponse.Controls)
                {
                    if (control is DirSyncResponseControl)
                    {
                        DirSyncResponseControl dsrc = control as DirSyncResponseControl;
                        cookie = dsrc.Cookie;
                        bMoreData = dsrc.MoreData;
                        break;
                    }
                }
                dirSyncRC.Cookie = cookie;
                searchResponse = (SearchResponse)connection.SendRequest(request);
            }


            //Serialize the cookie into a file to use in next searches
            using (FileStream fsStream = new FileStream(strFileName, FileMode.Create))
            {
                //Serialize the data to the steam. To get the data for 
                //the cookie, call the GetDirectorySynchronizationCookie method.
               bFormat.Serialize(fsStream, cookie);
            }

            Console.WriteLine("Finished search...");
            Console.ReadKey(); 

           }

Answer 1

解决方案需要将isDeleted=TRUE添加到请求对象

SearchRequest request = new SearchRequest("DC=xx,DC=xxx,DC=com", 
  "(|(objectClass=organizationalUnit)(isDeleted=TRUE)(objectCategory=Person))",
  SearchScope.Subtree, attribs);

Answer 2

至于我使用SearchRequest的经验，过滤器不会不惜任何代价，它有自己的问题..对于你的案例来获取删除对象的更改你应该使用Domain Admin特权帐户或类似的东西..

在此，您需要授予对“已删除对象”容器具有完全权限的特权帐户。

System.Net.NetworkCredential cr = new System.Net.NetworkCredential(@"administrator", "xxx", "xxx");
        LdapConnection connection = new LdapConnection(str_dcName);

如何查询Active Directory中包含已删除对象的更改？

2 个答案: