獲取Active Directory組的成員並檢查它們是啓用還是禁用

Question

獲取給定AD組中所有成員/用戶列表並確定用戶是否啓用（或禁用）的最快方法是什麼？

我們可能在談論20K用戶，所以我想避免爲每個用戶點擊AD。

Answer 1

如果您使用的是.NET 3.5及更高版本，則應檢查System.DirectoryServices.AccountManagement（S.DS.AM）命名空間。在這裏閱讀全部內容：

• Managing Directory Security Principals in the .NET Framework 3.5
• MSDN docs on System.DirectoryServices.AccountManagement

基本上，你可以定義域範圍內，並可以輕鬆地查找用戶和/或組AD：

// set up domain context 
PrincipalContext ctx = new PrincipalContext(ContextType.Domain); 

// find the group in question 
GroupPrincipal group = GroupPrincipal.FindByIdentity(ctx, "YourGroupNameHere"); 

// if found.... 
if (group != null) 
{ 
    // iterate over members 
    foreach (Principal p in group.GetMembers()) 
    { 
     Console.WriteLine("{0}: {1}", p.StructuralObjectClass, p.DisplayName); 

     // do whatever you need to do to those members 
     UserPrincipal theUser = p as UserPrincipal; 

     if(theUser != null) 
     { 
      if(theUser.IsAccountLockedOut()) 
      { 
       ... 
      } 
      else 
      { 
       ... 
      } 
     } 
    } 
} 

的新的S.DS.AM可以很容易地與AD中的用戶和羣組玩耍！

Answer 2

請你可以試試下面的代碼。它使用Search Filter Syntax以遞歸方式在一個LDAP查詢中獲取所需內容。興趣是查詢在服務器上完成。我不確定它比@marc_s解決方案更快，但它存在，它可以在.NET 2.0（開始W2K3 SP2）上運行。

string sFromWhere = "LDAP://WM2008R2ENT:389/dc=dom,dc=fr"; 
DirectoryEntry deBase = new DirectoryEntry(sFromWhere, "dom\\jpb", "test.2011"); 

/* To find all the users member of groups "Grp1" : 
* Set the base to the groups container DN; for example root DN (dc=societe,dc=fr) 
* Set the scope to subtree 
* Use the following filter : 
* (member:1.2.840.113556.1.4.1941:=CN=Grp1,OU=MonOu,DC=X) 
* coupled with LDAP_MATCHING_RULE_BIT_AND on userAccountControl with ACCOUNTDISABLE 
*/ 
DirectorySearcher dsLookFor = new DirectorySearcher(deBase); 
dsLookFor.Filter = "(&(memberof:1.2.840.113556.1.4.1941:=CN=MonGrpSec,OU=MonOu,DC=dom,DC=fr)(userAccountControl:1.2.840.113556.1.4.803:=2))"; 
dsLookFor.SearchScope = SearchScope.Subtree; 
dsLookFor.PropertiesToLoad.Add("cn"); 

SearchResultCollection srcUsers = dsLookFor.FindAll(); 

/* Just to know if user is present in an other group 
*/ 
foreach (SearchResult srcUser in srcUsers) 
{ 
    Console.WriteLine("{0}", srcUser.Path); 
}