The .Net Developer's Guide to Directory Services Programming

DirectoryEntry parent = new DirectoryEntry(
    "LDAP://OU=people,DC=mydomain,DC=com",
    null,
    null,
    AuthenticationTypes.Secure
    );
	
DirectoryEntry user =
    parent.Children.Add("CN=test.user", "user");
using (user)

{
    //sAMAccountName is required for W2k AD, we would not use
    //this for ADAM, however.
    user.Properties["sAMAccountName"].Value = "test.user";
    //userPrincipalName is not required, but recommended
    //for ADAM. AD also contains this, so we can use it.
    user.Properties["userPrincipalName"].Value = "test.user";
    user.CommitChanges();
}

[Flags]
public enum AdsUserFlags
{
    Script = 1, // 0x1
    AccountDisabled = 2, // 0x2
    HomeDirectoryRequired = 8, // 0x8
    AccountLockedOut = 16, // 0x10
    PasswordNotRequired = 32, // 0x20
    PasswordCannotChange = 64, // 0x40
    EncryptedTextPasswordAllowed = 128, // 0x80
    TempDuplicateAccount = 256, // 0x100
    NormalAccount = 512, // 0x200
    InterDomainTrustAccount = 2048, // 0x800
    WorkstationTrustAccount = 4096, // 0x1000
    ServerTrustAccount = 8192, // 0x2000
    PasswordDoesNotExpire = 65536, // 0x10000
    MnsLogonAccount = 131072, // 0x20000
    SmartCardRequired = 262144, // 0x40000
    TrustedForDelegation = 524288, // 0x80000
    AccountNotDelegated = 1048576, // 0x100000
    UseDesKeyOnly= 2097152, // 0x200000
    DontRequirePreauth= 4194304, // 0x400000
    PasswordExpired = 8388608, // 0x800000
    TrustedToAuthenticateForDelegation = 16777216, // 0x1000000
    NoAuthDataRequired = 33554432 // 0x2000000
}

DirectoryEntry user = new DirectoryEntry(
    "LDAP://CN=User1,CN=users,DC=domain,DC=com",
    null,
    null,
    AuthenticationTypes.Secure
    );
	
AdsUserFlags userFlags = (AdsUserFlags)
    user.Properties["userAccountControl"].Value;

Console.WriteLine(
    "AdsUserFlags for {0}: {1}",
    user.Path,
    userFlags
    );

DirectoryEntry entry = new DirectoryEntry(
    "LDAP://CN=some user,CN=users,DC=mydomain,DC=com",
    null,
    null,
    AuthenticationTypes.Secure
    );

    AdsUserFlags newValue = AdsUserFlags.NormalAccount
    | AdsUserFlags.DontExpirePassword;

entry.Properties["userAccountControl"].Value = newValue;
entry.CommitChanges()

DirectoryEntry user = new DirectoryEntry(
    "LDAP://CN=User1,CN=users,DC=domain,DC=com",
    null,
    null,
    AuthenticationTypes.Secure
    );

//this is a pain to type a lot :)
string msDS = "msDS-User-Account-Control-Computed";

using (user)
{
   //this is constructed attribute
    user.RefreshCache(
        new string[]{msDS}
        );

   AdsUserFlags userFlags =
        (AdsUserFlags)user.Properties[msDS].Value;

    Console.WriteLine(
        "AdsUserFlags for {0}: {1}",
        user.Path,
        userFlags
        );
}

string adsPath =
    "LDAP://localhost:389/"
    + "CN=User1,OU=Users,O=dunnry,C=US";

DirectoryEntry user = new DirectoryEntry(
    adsPath,
    null,
    null,
    AuthenticationTypes.Secure
    );

string attrib = "msDS-UserAccountDisabled";

using (user)
{
    //disable the account
    user.Properties[attrib].Value = true;
    user.CommitChanges();
}

[Flags]
public enum PasswordPolicy
{
    DOMAIN_PASSWORD_COMPLEX=1,
    DOMAIN_PASSWORD_NO_ANON_CHANGE=2,
   DOMAIN_PASSWORD_NO_CLEAR_CHANGE=4,
    DOMAIN_LOCKOUT_ADMINS=8,
    DOMAIN_PASSWORD_STORE_CLEARTEXT=16,
    DOMAIN_REFUSE_PASSWORD_CHANGE=32
}
public class DomainPolicy
{
    ResultPropertyCollection attribs;

    public DomainPolicy(DirectoryEntry domainRoot)
    {

        string[] policyAttributes = new string[] {
            "maxPwdAge", "minPwdAge", "minPwdLength",
            "lockoutDuration", "lockOutObservationWindow",
            "lockoutThreshold", "pwdProperties",
            "pwdHistoryLength", "objectClass",
            "distinguishedName"
            };

        //we take advantage of the marshaling with
        //DirectorySearcher for LargeInteger values...
        DirectorySearcher ds = new DirectorySearcher(
            domainRoot,
            "(objectClass=domainDNS)",
            policyAttributes,
            SearchScope.Base
            );

        SearchResult result = ds.FindOne();

        //do some quick validation...
        if (result == null)
        {
            throw new ArgumentException(
               "domainRoot is not a domainDNS object."
               );
        }

        this.attribs = result.Properties;
    }
    //for some odd reason, the intervals are all stored
    //as negative numbers. We use this to "invert" them
    private long GetAbsValue(object longInt)
    {
        return Math.Abs((long)longInt);
    }
    public TimeSpan MaxPasswordAge
    {
        get
        {
            string val = "maxPwdAge";
           if (this.attribs.Contains(val))
           {
               long ticks = GetAbsValue(
                   this.attribs[val][0]
                   );

               if (ticks > 0)
                   return TimeSpan.FromTicks(ticks);
           }

           return TimeSpan.MaxValue;
        }
    }

    public PasswordPolicy PasswordProperties
    {
        get
        {
            string val = "pwdProperties";
            //this should fail if not found
            return (PasswordPolicy)this.attribs[val][0];
        }
    }

    //truncated for book space
}

public class PasswordExpires
{
    DomainPolicy policy;
	
    const int UF_DONT_EXPIRE_PASSWD = 0x10000;

public PasswordExpires()
{
    //get our current domain policy
    Domain domain = Domain.GetCurrentDomain();
    DirectoryEntry root = domain.GetDirectoryEntry();

    using (domain)
    using (root)
    {
        this.policy = new DomainPolicy(root);
    }
}

public DateTime GetExpiration(DirectoryEntry user)
{
    int flags =
        (int)user.Properties["userAccountControl"][0];

    //check to see if password is set to expire
    if(Convert.ToBoolean(flags & UF_DONT_EXPIRE_PASSWD))
    {
        //the user's password will never expire
        return DateTime.MaxValue;
    }

    long ticks = GetInt64(user, "pwdLastSet");

    //user must change password at next login
    if (ticks == 0)
        return DateTime.MinValue;

    //password has never been set
    if (ticks == -1)
    {
        throw new InvalidOperationException(
           "User does not have a password"
           );
    }

    //get when the user last set their password;
    DateTime pwdLastSet = DateTime.FromFileTime(
        ticks
        );
    //use our policy class to determine when
    //it will expire
    return pwdLastSet.Add(
        this.policy.MaxPasswordAge
       );
}

public TimeSpan GetTimeLeft(DirectoryEntry user)
{
   DateTime willExpire = GetExpiration(user);
   
    if (willExpire == DateTime.MaxValue)
        return TimeSpan.MaxValue;

    if (willExpire == DateTime.MinValue)
        return TimeSpan.MinValue;
		
    if (willExpire.CompareTo(DateTime.Now) > 0)
    {
        //the password has not expired
        //(pwdLast + MaxPwdAge)- Now = Time Left
       return willExpire.Subtract(DateTime.Now);
    }

     //the password has already expired
    return TimeSpan.MinValue;
}

private Int64 GetInt64(DirectoryEntry entry, string attr)
{
    //we will use the marshaling behavior of
    //the searcher
    DirectorySearcher ds = new DirectorySearcher(
         entry,
         String.Format("({0}=*)", attr),
        new string[] { attr },
        SearchScope.Base
        );

    SearchResult sr = ds.FindOne();

    if (sr != null)
    {
        if (sr.Properties.Contains(attr)) 
        {
            return (Int64)sr.Properties[attr][0];
       }
    }
    return -1;
}

string adsPath = "LDAP://CN=User1,OU=Users,DC=domain,DC=com";

DirectoryEntry user = new DirectoryEntry(
    adsPath,
    null,
    null,
    AuthenticationTypes.Secure
    );

string attrib = "msDS-User-Account-Control-Computed";

using (user)
{
    user.RefreshCache(new string[] { attrib });

    int flags = (int)user.Properties[attrib].Value
        & (int)AdsUserFlags.PasswordExpired);

    if (Convert.ToBoolean(flags)
    {
        //password has expired
        Console.WriteLine("Expired");
    }
}

public static string GetExpirationFilter(
    DateTime startDate,
    DateTime endDate,
    TimeSpan maxPwdAge
    )
{
    Int64 lowDate;
    Int64 highDate;
    string filterPattern = "(&(sAMAccountType=805306368)" +
        "(pwdLastSet>={0})(pwdLastSet<={1}))"

    lowDate = startDate.Subtract(maxPwdAge).ToFileTime();
    highDate = endDate.Subtract(maxPwdAge).ToFileTime();

    return String.Format(
        filterPattern,
        lowDate,
        highDate
        );
}

string username = "user1";
string domain = "mydomain.com";

public static void LastLogon(string username, string domain)
{

    DirectoryContext context = new DirectoryContext(
        DirectoryContextType.Domain,
        domain
        );

        DateTime latestLogon = DateTime.MinValue;
        string servername = null;

        DomainControllerCollection dcc =
            DomainController.FindAll(context);
        foreach (DomainController dc in dcc)
        {
            DirectorySearcher ds;

            using (dc)
            using (ds = dc.GetDirectorySearcher())
            {
                ds.Filter = String.Format(
                    "(sAMAccountName={0})",
                    username
                    );
                ds.PropertiesToLoad.Add("lastLogon");
                ds.SizeLimit = 1;

                SearchResult sr = ds.FindOne();

                if (sr != null)
                {

                    DateTime lastLogon = DateTime.MinValue;
                    if (sr.Properties.Contains("lastLogon"))
                    {
                        lastLogon = DateTime.FromFileTime(
                            (long)sr.Properties["lastLogon"][0]
                            );
                    }
                    if (DateTime.Compare(lastLogon,latestLogon) > 0)
                    {
                        latestLogon = lastLogon;
                        servername = dc.Name;
                    }
                }
            }
        }
        
		Console.WriteLine(
            "Last Logon: {0} at {1}",
            servername,
            latestLogon.ToString()
            );
}

//user is a DirectoryEntry for our user account

string attrib = "msDS-User-Account-Control-Computed";

//this is a constructed attrib
user.RefreshCache(new string[]{attrib});

const int UF_LOCKOUT = 0x0010;

int flags =
    (int)user.Properties[attrib].Value;
	
if (Convert.ToBoolean(flags & UF_LOCKOUT))
{

    Console.WriteLine(
        "{0} is locked out",
        user.Name
        );
}

class Lockout : IDisposable
{
    DirectoryContext context;
    DirectoryEntry root;
    DomainPolicy policy;

    public Lockout(string domainName)
    {
        this.context = new DirectoryContext(
            DirectoryContextType.Domain,
            domainName
            );
			
        //get our current domain policy
        Domain domain = Domain.GetDomain(this.context);
		
        this.root = domain.GetDirectoryEntry();
        this.policy = new DomainPolicy(this.root);
    }
	
    public void FindLockedAccounts()
    {
        //default for when accounts stay locked indefinitely
        string qry = "(lockoutTime>=1)";
		
        TimeSpan duration = this.policy.LockoutDuration;
		
        if (duration != TimeSpan.MaxValue)
        {
		
        DateTime lockoutThreshold =
            DateTime.Now.Subtract(duration);
        qry = String.Format(
            "(lockoutTime>={0})",
            lockoutThreshold.ToFileTime()
            );
    }
	
    DirectorySearcher ds = new DirectorySearcher(
        this.root,
        qry
         );

       using (SearchResultCollection src = ds.FindAll())
       {
           foreach (SearchResult sr in src)
           {
               long ticks =
                   (long)sr.Properties["lockoutTime"][0];

               Console.WriteLine(
                   "{0} locked out at {1}",
                   sr.Properties["name"][0],
                   DateTime.FromFileTime(ticks)
                   );
            }
        }
    }

    public void Dispose()
    {
        if (this.root != null)
        {
            this.root.Dispose();
        }
    }
}

using System;
using System.DirectoryServices.Protocols;
using System.Net;
using System.Text;

public class PasswordModifier
{
    public static void Main()
    {
        NetworkCredential credential = new NetworkCredential(
            "someuser",
            "Password1",
            "domain"
            );
        DirectoryConnection connection;

        try
        {
            //change these options to use Kerberos encryption
            connection = GetConnection(
                "domain.com:636",
                credential,
                true
                );
				
            ChangePassword(
                connection,
                "CN=someuser,CN=users,DC=domain,DC=com",
                "Password1",
                "Password2"
                );
				
            Console.WriteLine("Password modified!");
            IDisposable disposable = connection as IDisposable;
                if (disposable != null)
                    disposable.Dispose();
            }
            catch (Exception ex)
            {
               Console.WriteLine(ex.ToString());
            }
        }
		
        private static DirectoryConnection GetConnection(
            string server,
            NetworkCredential credential,
            bool useSsl
            )
        {
            LdapConnection connection =
                new LdapConnection(server);
				
            if (useSsl)
            {
                connection.SessionOptions.SecureSocketLayer = true;
            }
            else
            {
               connection.SessionOptions.Sealing = true;
            }
            connection.Bind(credential);
            return connection;
        }
        private static void ChangePassword(
            DirectoryConnection connection,
            string userDN,
            string oldPassword,
            string newPassword
            )
        {
            DirectoryAttributeModification deleteMod =
                new DirectoryAttributeModification();
            deleteMod.Name = "unicodePwd";
            deleteMod.Add(GetPasswordData(oldPassword));
            deleteMod.Operation= DirectoryAttributeOperation.Delete;
			
            DirectoryAttributeModification addMod =
                new DirectoryAttributeModification();
            addMod.Name = "unicodePwd";
            addMod.Add(GetPasswordData(newPassword));
            addMod.Operation = DirectoryAttributeOperation.Add;
            ModifyRequest request = new ModifyRequest(
                userDN,
                deleteMod,
                addMod
                );
				
           DirectoryResponse response =
               connection.SendRequest(request);
    }
	
    private static void SetPassword(
        DirectoryConnection connection,
        string userDN,
        string password
        )
    {
        DirectoryAttributeModification pwdMod =
            new DirectoryAttributeModification();
        pwdMod.Name = "unicodePwd";
        pwdMod.Add(GetPasswordData(password));
        pwdMod.Operation = DirectoryAttributeOperation.Replace;
		
        ModifyRequest request = new ModifyRequest(
            userDN,
            pwdMod
            );

       DirectoryResponse response =
            connection.SendRequest(request);
    }
    private static byte[] GetPasswordData(string password)
    {
        string formattedPassword;
        formattedPassword = String.Format("\"{0}\"", password);
        return (Encoding.Unicode.GetBytes(formattedPassword));
    }
}

//.NET 2.0 sample for ADAM password changes
DirectoryEntry entry = new DirectoryEntry(
    "LDAP://adamserver.com/CN=someuser,OU=users,O=adamsample",
    "someuser@adam",
    "UserPassword1",
    AuthenticationTypes.None
    );
    entry.Options.PasswordPort = 389;
    entry.Options.PasswordEncoding =
       PasswordEncodingMethod.PasswordEncodingClear;

    entry.Invoke(
        "ChangePassword",
        new object[] {"UserPassword1", "UserPassword2"}
        );

//.NET 1.x sample
const int ADS_OPTION_PASSWORD_PORTNUMBER = 6;
const int ADS_OPTION_PASSWORD_METHOD = 7;
const int ADS_PASSWORD_ENCODE_CLEAR = 1;

DirectoryEntry entry = new DirectoryEntry(
    "LDAP://adamserver.com/CN=someuser,OU=users,O=adamsample",
    "someuser@adam",
    "UserPassword1",
    AuthenticationTypes.None
    );
entry.Invoke(
    "SetOption",
    new object[] {ADS_OPTION_PASSWORD_PORTNUMBER, 389}
    );
entry.Invoke(
    "SetOption",
    new object[] {
    ADS_OPTION_PASSWORD_METHOD,
    ADS_PASSWORD_ENCODE_CLEAR
    }
    );
entry.Invoke(
    "ChangePassword",
    new object[] {"UserPassword1", "UserPassword2"}
    );

    StringBuilder sb = new StringBuilder();

    //we are building an '|' clause
    sb.Append("(|");

    foreach (byte[] sid in user.Properties["tokenGroups"])
    {
        //append each member into the filter
        sb.AppendFormat(
            "(objectSid={0})", BuildFilterOctetString(sid));
    }

    //end our initial filter
    sb.Append(")");

    DirectoryEntry searchRoot = new DirectoryEntry(
        "LDAP://DC=domain,DC=com",
        null,
        null,
        AuthenticationTypes.Secure
        );

    using (searchRoot)
    {
    //we now have our filter, we can just search for the groups
    DirectorySearcher ds = new DirectorySearcher(
        searchRoot,
        sb.ToString() //our filter
        );

    using (SearchResultCollection src = ds.FindAll())
    {

        foreach (SearchResult sr in src)
        {
            //Here is each group now...
            Console.WriteLine(
                sr.Properties["samAccountName"][0]);
        }
    }
}
private string BuildFilterOctetString(byte[] bytes)
{
    //see listing 4.2 for the complete code
}

//convert to array of string SIDs
int size = this.Properties["tokenGroups"].Count;
PropertyValueCollection pvc = this.Properties["tokenGroups"];

string[] sids = new string[size];

for (int i=0; i < size; i++)
{
    sids[i] = AdUtils.ConvertSidToSidString((byte[])pvc[i]);
}

//we want to pass in the SID format and retrieve
//the NT Format names. This utility class is
//included in our web site library samples
//groupNames contains all the converted groups now
string[] groupNames = AdUtils.DsCrackNamesWrapper(
    sids,
    this.Context.Handle,
    DS_NAME_FORMAT.DS_SID_OR_SID_HISTORY_NAME,
    DS_NAME_FORMAT.DS_NT4_ACCOUNT_NAME
    );

//we use the collection in order to
//batch the request for translation
IdentityReferenceCollection irc
    = ExpandTokenGroups(user).Translate(typeof(NTAccount));

foreach (NTAccount account in irc)
{
    Console.WriteLine(account);
}

//Sample Helper Function
private IdentityReferenceCollection ExpandTokenGroups(
    DirectoryEntry user)
{
    user.RefreshCache(new string[]{"tokenGroups"});

    IdentityReferenceCollection irc =
        new IdentityReferenceCollection();

    foreach (byte[] sidBytes in user.Properties["tokenGroups"])
    {
        irc.Add(new SecurityIdentifier(sidBytes, 0));
    }
    return irc;
}