Active Directory 常用屬性

1.獲取DirectoryEntry

string str = string.Empty;

string strPath = @LDAP://testDomain.com.mo;

string ad = "testAD";

System.DirectoryServices.DirectorySearcher sea = new System.DirectoryServices.DirectorySearcher(strPath);
sea.Filter = "(&(objectCategory=user)(sAMAccountName=" + ad + "))";
System.DirectoryServices.SearchResult res = sea.FindOne();
System.DirectoryServices.DirectoryEntry d = new System.DirectoryServices.DirectoryEntry();
d.Path = res.Path;
foreach (string p in d.Properties.PropertyNames)
{
     str += string.Format("{0}:{1}\r\n",p , d.Properties[p].Value.ToString());
}

2.基本資訊name,givenName.distinguishedName,displayName,mailNickname
http://tech.ddvip.com/2013-01/1358156532188866.html

3.定位資訊
sAMAccountName:ad
sAMAccountType:805306368        all user objects
"(sAMAccountType=805306368)" 
"(&(objectCategory=person)(objectClass=user)(cn=Joe*))"
"(&(objectCategory=group)(|(cn=Test*)(cn=Admin*)))"

ADO Search Tips
http://www.rlmueller.net/ADOSearchTips.htm

4.許可權碼userAccountControl啟用512,禁用514,密碼永不過期66048
enable: 

	d.Properties["userAccountControl"].Value = 512 & ~0x2;

	user.CommitChanges();

disable:
	d.Properties["userAccountControl"].Value = 512 | 0x2;

unlock:

	d.Properties["LockOutTime"].Value = 0;
reset password:
	d.Invoke("SetPassword", new object[] { password });
        d.Properties["LockOutTime"].Value = 0; 
	d.Properties["pwdLastSet"].Value = 0;

pwdLastSet

badPwdCount 使用者嘗試錯誤密碼的次數
badPasswordTime 使用者最後一次嘗試錯誤密碼的時間
lastLogon 使用者最後登陸時間
accountExpires 帳戶到期日期

Constant Hexadecimal value Decimal value
ADS_UF_NORMAL_ACCOUNT 0x200 512
ADS_UF_ACCOUNTDISABLE 0x0002 2
ADS_PASSWD_NOTREQD 0x0020 3
PASSWORD_EXPIRED 512 | 0x800000
http://blog.sina.com.cn/s/blog_6d6712230100ls0v.html

5.adsiedit.msc
http://www.cnblogs.com/dragonwlb/archive/2012/08/06/2625474.html