Question

我正在Active Directory中搜索特定OU中的用户。我只获得最近30天内登录的用户。

我的搜索过滤器查询是：

string query = "(&(objectCategory=person)(objectClass=user)((lastLogon<=" + new DateTime(DateTime.Now.AddDays(-30).Ticks) + ")(mail=*))";

我得到搜索过滤器无效我用过：

string query = "(&(objectCategory=person)(objectClass=user)((lastLogon=*)(mail=*))";

没有错误

我修改了最后一次登录，如下所示：

(lastLogon<=1)

我正在调用执行此操作的方法

public static DataTable GetADusers() {
    try {
        string ou = "OU";

        using(PrincipalContext ctx = new PrincipalContext(ContextType.Domain, Environment.UserDomainName, ou)) {
            UserPrincipal user = new UserPrincipal(ctx);
            using(PrincipalSearcher ps = new PrincipalSearcher(user)) {
                DataTable results = new DataTable();

                results.Columns.Add("DisplayName ");
                results.Columns.Add("FirstName");
                results.Columns.Add("Initial");
                results.Columns.Add("LastName");
                results.Columns.Add("mail");
                results.Columns.Add("SamAccountName");
                results.Columns.Add("DistinguishedName");
                results.Columns.Add("lastLogon");

                int count = 0;

                int ctNull = 0;

                foreach(Principal p in ps.FindAll()) {
                    UserPrincipal u = p as UserPrincipal;
                    if (u != null) {
                        DirectoryEntry entry = (DirectoryEntry) p.GetUnderlyingObject();
                        DirectorySearcher search = new DirectorySearcher(entry);

                        string query = "(&(objectCategory=person)(objectClass=user)((lastLogon<=" + new DateTime(DateTime.Now.AddDays( - 30).Ticks) + ")(mail=*))";

                        search.Filter = query;
                        search.PropertiesToLoad.Add("DisplayName");
                        search.PropertiesToLoad.Add("GivenName");
                        search.PropertiesToLoad.Add("Initials");
                        search.PropertiesToLoad.Add("sn");
                        search.PropertiesToLoad.Add("mail");
                        search.PropertiesToLoad.Add("SamAccountName");
                        search.PropertiesToLoad.Add("DistinguishedName");
                        search.PropertiesToLoad.Add("lastLogon");

                        SearchResultCollection mySearchResultColl = search.FindAll();

                        foreach(SearchResult sr in mySearchResultColl) {
                            DataRow dr = results.NewRow();
                            DirectoryEntry de = sr.GetDirectoryEntry();
                            dr["EmployeeID"] = de.Properties["EmployeeID"].Value;
                            dr["DisplayName "] = de.Properties["DisplayName"].Value;
                            dr["FirstName"] = de.Properties["GivenName"].Value;
                            dr["Initial"] = de.Properties["Initials"].Value;
                            dr["LastName"] = de.Properties["sn"].Value;
                            dr["mail"] = de.Properties["mail"].Value;
                            dr["SamAccountName"] = de.Properties["SamAccountName"].Value;
                            dr["DistinguishedName"] = de.Properties["DistinguishedName"].Value;
                            //prepare for last logon
                            if (de.Properties["lastLogon"] != null && de.Properties["lastLogon"].Count > 0) {
                                Int64 lastLogonThisServer = new Int64();
                                IADsLargeInteger lgInt = (IADsLargeInteger) de.Properties["lastLogon"].Value;
                                lastLogonThisServer = ((long) lgInt.HighPart << 32) + lgInt.LowPart;
                                dr["lastLogon"] = DateTime.FromFileTime(lastLogonThisServer).ToString();
                            }
                            else {
                                dr["lastLogon"] = DateTime.MinValue.ToString();
                                ctNull++;
                            }

                            results.Rows.Add(dr);
                            count++;

                        }

                    }
                }
                Console.WriteLine(count);
                Console.WriteLine("Null");
                Console.WriteLine(ctNull);

                return results;
            }

        }
    }
    catch(NullReferenceException ex) {
        Console.WriteLine("data error" + ex);
        DataTable dt = new DataTable();
        return dt;
    }
}

以上功能效果很好！必须有一种方法来检查上次登录是否已超过30天。我将不胜感激任何帮助。谢谢！

下面的答案是正确的谢谢

我必须添加以下代码以将数据放入数据库：

            if (de.Properties["LastLogonTimestamp"] != null && de.Properties["LastLogonTimestamp"].Count > 0)
                                {
                                    Int64 lastLogonDateThisServer = new Int64();
                                    IADsLargeInteger lgInt = (IADsLargeInteger)de.Properties["LastLogonTimestamp"].Value;
                                    lastLogonDateThisServer = ((long)lgInt.HighPart << 32) + lgInt.LowPart;
                                    dr["LastLogonTimestamp"] = DateTime.FromFileTime(lastLogonDateThisServer).ToString();

                                }
                                else
                                {

                                    dr["LastLogonTimestamp"] = DateTime.MinValue.ToString();
                                    ctNull++;
                                }

我将其放在lastLogon下方对于查询过滤器：我必须反转<才能将数据从现在到30天。

                            string query = "(&(objectCategory=person)(objectClass=user)(!userAccountControl:1.2.840.113556.1.4.803:=2)(!userAccountControl:1.2.840.113556.1.4.803:=65536)(userAccountControl:1.2.840.113556.1.4.803:=262144)(userPrincipalName=1*@mil)(lastlogon>=" + DateTime.Now.AddDays(-90).ToFileTime() + ")(lastLogonTimestamp>=" + DateTime.Now.AddDays(-90).ToFileTime() + ")(mail=*))";

Answer 1

在查询中，lastLogon前面有两个不需要的括号：

((lastLogon<=...

这就是为什么您会收到“搜索过滤器无效”错误的原因。应该是：

(lastLogon<=...

但是您还计算了错误的值。你有这个：

new DateTime(DateTime.Now.AddDays( - 30).Ticks)

但是lastLogon不使用刻度。

稍后在代码中，您正在使用FromFileTime回读lastLogon。同样，您可以使用ToFileTime将日期转换为查询中可以使用的格式。像这样：

DateTime.Now.AddDays(-30).ToFileTime()

但是请记住，lastLogon不会复制-仅在用户进行身份验证的最后一个域控制器上正确。因此，如果您的域有多个域控制器，则大多数帐户将无法获得准确的价值。

正是出于这个原因创建了lastLogonTimestamp属性。它至少每2周复制一次，因此您知道该值在2周内是准确的。您可以为此使用相同的格式：

string query = "(&(objectCategory=person)(objectClass=user)(lastLogonTimestamp<="
    + DateTime.Now.AddDays(-30).ToFileTime() + ")(mail=*))";

您可以在此处了解有关lastLogonTimestamp属性的更多信息：https://blogs.technet.microsoft.com/askds/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works/

DirectorySearcher过滤如何基于最近30天进行限制

1 个答案: