Question

是否可以使用LDAP命令在Active Directory中启用（或禁用）用户？

而且，是否可以使用C＃进行此操作？

我已经看过了 here 和 here

谢谢，

Ĵ

Answer 1

您可以使用PrincipalContext启用/禁用AD帐户。要启用AD，您可以执行以下操作：

 private static void EnableADUserUsingUserPrincipal(string username)
     {
       try
    {                
        PrincipalContext principalContext = new PrincipalContext(ContextType.Domain);

        UserPrincipal userPrincipal = UserPrincipal.FindByIdentity
                (principalContext, username);

        userPrincipal.Enabled = true;

        userPrincipal.Save();

    }
    catch (Exception ex)
    {
        Console.WriteLine(ex.Message);
    }
 }

要停用Active Directory，您只需设置 userPrincipal.Enabled = false;

Answer 2

使用此引用Howto: (Almost) Everything In Active Directory via C#

您可以使用“ userAccountControl ”属性启用和停用

您需要将DirectoryEntry传递给函数

启用：

public static void Enable(DirectoryEntry user)
    {
        try
        {
            int val = (int)user.Properties["userAccountControl"].Value;
            user.Properties["userAccountControl"].Value = val & ~0x2;
            //ADS_UF_NORMAL_ACCOUNT;

            user.CommitChanges();
            user.Close();
        }
        catch (System.DirectoryServices.DirectoryServicesCOMException E)
        {
            //DoSomethingWith --> E.Message.ToString();

        }
    }

禁用：

public void Disable(DirectoryEntry user)
{
    try
    {
        int val = (int)user.Properties["userAccountControl"].Value;
        user.Properties["userAccountControl"].Value = val | 0x2; 
             //ADS_UF_ACCOUNTDISABLE;

        user.CommitChanges();
        user.Close();
    }
    catch (System.DirectoryServices.DirectoryServicesCOMException E)
    {
        //DoSomethingWith --> E.Message.ToString();

    }
}

Answer 3

使用：Morgan Tech Space作为参考：

使用C＃

通过userAccountControl启用Active Directory用户帐户

private static void EnableADUserUsingUserAccountControl(string username)
 {
    try
    {
        DirectoryEntry domainEntry = Domain.GetCurrentDomain().GetDirectoryEntry();
        // ldap filter
        string searchFilter = string.Format(@"(&(objectCategory=person)(objectClass=user)
                (!sAMAccountType=805306370)(|(userPrincipalName={0})(sAMAccountName={0})))", username);

        DirectorySearcher searcher = new DirectorySearcher(domainEntry, searchFilter);
        SearchResult searchResult = searcher.FindOne();
        if (searcher != null)
        {
            DirectoryEntry userEntry = searchResult.GetDirectoryEntry();

            int old_UAC=(int)userEntry.Properties["userAccountControl"][0];

            // AD user account disable flag
            int ADS_UF_ACCOUNTDISABLE = 2;

            // To enable an ad user account, we need to clear the disable bit/flag:
            userEntry.Properties["userAccountControl"][0] = (old_UAC & ~ADS_UF_ACCOUNTDISABLE);
            userEntry.CommitChanges();

            Console.WriteLine("Active Director User Account Enabled successfully 
                                      through userAccountControl property");
        }
        else
        {
            //AD User Not Found
        }
    }
    catch (Exception ex)
    {
        Console.WriteLine(ex.Message);
    }
}

使用C＃

通过userAccountControl禁用Active Directory用户帐户

private static void DisableADUserUsingUserAccountControl(string username)
{
    try
    {
        DirectoryEntry domainEntry = Domain.GetCurrentDomain().GetDirectoryEntry();
        // ldap filter
        string searchFilter = string.Format(@"(&(objectCategory=person)(objectClass=user)
              (!sAMAccountType=805306370)(|(userPrincipalName={0})(sAMAccountName={0})))", username);

        DirectorySearcher searcher = new DirectorySearcher(domainEntry, searchFilter);
        SearchResult searchResult = searcher.FindOne();
        if (searcher != null)
        {
            DirectoryEntry userEntry = searchResult.GetDirectoryEntry();

            int old_UAC = (int)userEntry.Properties["userAccountControl"][0];

            // AD user account disable flag
            int ADS_UF_ACCOUNTDISABLE = 2;

            // To disable an ad user account, we need to set the disable bit/flag:
            userEntry.Properties["userAccountControl"][0] = (old_UAC | ADS_UF_ACCOUNTDISABLE);
            userEntry.CommitChanges();

            Console.WriteLine("Active Director User Account Disabled successfully 
                                through userAccountControl property");
        }
        else
        {
            //AD User Not Found
        }
    }
    catch (Exception ex)
    {
        Console.WriteLine(ex.Message);
    }
}

使用C＃

通过UserPrincipal启用AD用户帐户

private static void EnableADUserUsingUserPrincipal(string username)
{
    try
    {                
        PrincipalContext principalContext = new PrincipalContext(ContextType.Domain);

        UserPrincipal userPrincipal = UserPrincipal.FindByIdentity
                (principalContext, username);

        userPrincipal.Enabled = true;

        userPrincipal.Save();

        Console.WriteLine("Active Director User Account Enabled successfully through UserPrincipal");
    }
    catch (Exception ex)
    {
        Console.WriteLine(ex.Message);
    }
}

使用C＃

通过UserPrincipal禁用AD用户帐户

private static void DiableADUserUsingUserPrincipal(string username)
{
    try
    {
        // To use this class, you need add reference System.DirectoryServices.AccountManagement which

仅适用于.NET 3.5; PrincipalContext principalContext = new PrincipalContext（ContextType.Domain）;

        UserPrincipal userPrincipal = UserPrincipal.FindByIdentity
                (principalContext, username);

        userPrincipal.Enabled = false;

        userPrincipal.Save();

        Console.WriteLine("Active Director User Account Disabled successfully through UserPrincipal");
    }
    catch (Exception ex)
    {
        Console.WriteLine(ex.Message);
    }
}

使用LDAP启用/禁用AD用户

3 个答案: