$Users = Import-Csv -Path "C:\blah\Users.csv"
foreach ($User in $Users)
{
$Displayname = $User.'Firstname' + " " + $User.'Lastname'
$UserFirstname = $User.'Firstname'
$UserLastname = $User.'Lastname'
$OU = $User.'OU'
$SAM = $User.'SAM'
$UPN = $User.'Firstname' + "." + $User.'Lastname' + "@" + $User.'Maildomain'
$Password = $User.'Password'
$Email = $User.'Email'
New-ADUser -Name "$Displayname" -DisplayName "$Displayname" -SamAccountName $SAM -UserPrincipalName $UPN -GivenName "$UserFirstname" -Surname "$UserLastname" -Description "$Description" -AccountPassword (ConvertTo-SecureString $Password -AsPlainText -Force) -EmailAddress "$Email" -Enabled $true -Path "$OU" -ChangePasswordAtLogon $false –PasswordNeverExpires $true -server mydomain.local
Write-Host –NoNewLine "Adding user: "
Write-Host $SAM
}
$Users = Import-Csv -Path "C:\blah\Users.csv"
foreach ($User in $Users)
{
$SAM = $User.'SAM'
Add-ADGroupMember -Identity "My Group 1" -Member $SAM
Add-ADGroupMember -Identity "My Group 2" -Member $SAM
Write-Host –NoNewLine "Adding groups for user: "
Write-Host $SAM
} 
DirectoryEntry ldapConnection = null;with:
try
{
ldapConnection = new DirectoryEntry(LDAP fqdn, user, password);
}
ldapConnection = new DirectoryEntry(LDAP fqdn, user, password,Coming at this from another angle, this code also worked:
Password,AuthenticationTypes.SecureSocketsLayer);
or if you want to get fancy - refer c# LDAP check user is locked or notUserPrincipal oUserPrincipal = GetUser(sUserName);userPrincipal.IsAccountLockedOut();
string attribName = "msDS-User-Account-Control-Computed";user.RefreshCache(new string[] { attribName });const int UF_LOCKOUT = 0x0010;int userFlags = (int)user.Properties[attribName].Value;if ( (userFlags & UF_LOCKOUT) == UF_LOCKOUT){// if this is the case, the account is locked outreturn true;}return false;
UserPrincipal oUserPrincipal = GetUser(sUserName);
oUserPrincipal.UnlockAccount();
oUserPrincipal.Save();
To unlock via ADUC, click the Account tab on the user's Properties and then check the "Unlock Account" check box.
ADFS has this clever feature where if you select this mapping in the claims rules and map it to Roles, you will get a set of roles claims that contain all the groups for the authenticated user e.g.
http://schemas.microsoft.com/ws/2008/06/identity/claims/role Role1
That’s well and good when the groups are “flat” i.e. the groups are not memberOf other groups.
If they are, then this mapping will work it’s way up the hierarchy and display ALL the groups.
So if Joe is a memberOf Role1 and if Role1 is a memberOf Role2, then ADFS will construct:
http://schemas.microsoft.com/ws/2008/06/identity/claims/role Role1
http://schemas.microsoft.com/ws/2008/06/identity/claims/role Role2
Now that’s fine if that’s what you want but if Joe has 20 roles and all these roles are at the bottom of a whole pile of other roles you end up with many, many claims and a complete mess!
So what to do if you only want the bottom layer i.e. the actual memberOf.
If you go have a look via ADUC, guess what? memberOf is not displayed as an attribute!
WTF!
To see it as an attribute in the attribute list, you need to click the “Filter” box (bottom right) in “Attribute Editor” and then select “Backlinks”.
OK – so what if we set up a claims rule mapping memberOf to Roles?
So we type memberOf into the LDAP attribute field (it is actually editable) and note that it displays as “Is-Member-Of-DL”.
Problem!
What we get back is the whole CN e.g.
CN=Role1,OU=Sales,OU=company,DC=com
when what we got before was just Role1.
Enter stage left Joji Oshima. He da man!
Refer: AD FS 2.0 Claims Rule Language Part 2.
and have a look at “Problem 1” which is exactly the scenario described above.
Problem solved!
Enjoy!
There’s a lot of functionality in the AD API’s and there are neat API’s to enable / disable users but what if you want to search for them e.g. find all users in an OU that are currently disabled.
You could just search for all the users in an OU and then enumerate through all of them where:
user.Enabled = false;
but that’s a pain.
Enter RFC2254.
Or look here: Search Filter Syntax
What you will find is the matching rule OIDs.
e.g.
1.2.840.113556.1.4.803 = A match is found only if all bits from the attribute match the value. This rule is equivalent to a bitwise AND operator.
UAC is described here: Attributes for AD Users : userAccountControl.
Note that: Const ADS_UF_ACCOUNT_DISABLE = 2.
So now that we have laid the framework, back to the original question.
To search for disabled users, the filter would be:
(userAccountControl:1.2.840.113556.1.4.803:=2)
One of the problems with AD is “null” attributes i.e. attributes that in ADUC display as “not set”.
To search for these e.g. for email, use the filter:
(!(email=*))
* is the AD wildcard so this searches for users who don’t have an email address.
So to search for disabled users who don’t currently have an email address, use:
(&(userAccountControl:1.2.840.113556.1.4.803:=2)(!(email=*)))
This stuff does your head in!
Enjoy!
On Windows Server 2008, this doesn’t seem possible. There doesn’t appear to be an API that gives you all the details of the current user’s password policy.
Why does this matter?
Because when the user needs to pick a password and they get it wrong, the standard message is:
“The password you have chosen does not meet corporate policy. Please contact the help desk”.
The standard wrt. complexity is normally:
“The password contains characters from three of the following categories:
However, you can summarise the above and then get the pieces of the puzzle individually. To do this, you would have to get each attribute from AD.
Refer Windows Domain Password Policies
msDS-PasswordSettingsPrecedence
Establishes what takes precedence in situations where a user has membership in multiple groups with different password policies.
msDS-PasswordReversibleEncryptionEnabled
Toggles whether reversible encryption is enabled.
msDS-PasswordHistoryLength
Determines how many intervening passwords must be unique before one can be reused.
msDS-PasswordComplexityEnabled
Establishes the number and type of characters required in a password.
msDS-MinimumPasswordLength
Establishes the minimum length of a password.
msDS-MinimumPasswordAge
Determines how long a user must use a password before changing it.
msDS-MaximumPasswordAge
Determines how long a user can use a password before being required to change it.
msDS-LockoutThreshold
Determines how many failed password attempts will be allowed before locking out user account.
msDS-LockoutObservationWindow
Determines the time after which the bad password counter will be reset.
msDS-LockoutDuration
Determines how long the account will be locked out after too many failed password attempts.
So the message could be something like:
“Your password must be <msDS-MinimumPasswordLength> characters long, you cannot use one of your previous <msDS-PasswordHistoryLength> passwords and you will have to change it every <msDS-MaximumPasswordAge> days”.
Enjoy!
Quite often when you work with AD, you need some extra attributes to store customer specific information. I normally use the extensionAttributes (1 through 15) for this.
The problem is that they are not in AD out-the-box.
They are part of the Microsoft Exchange Server schema. The schema is the only part you have to install. You do NOT have to install Exchange.
Refer Prepare Active Directory and Domains
I used Exchange 2010 SP2. I guess you could download the trial version if you don’t have the DVD to hand?
To install, just run “Setup /PrepareSchema” to have the additional extension attributes added.
Note that you need to be a “Domain Admin” & “Schema Admin” & “Enterprise Admin” in order to run this script.
Enjoy!
There doesn’t seem to anything built into the .NET framework to do this and it’s a lot easier to read actual names rather than hex boolean manipulation so I rolled my own:
[Flags]
enum UserAccountControl
{
ADS_UF_SCRIPT = 1, // 0x1
ADS_UF_ACCOUNTDISABLE = 2, // 0x2
ADS_UF_HOMEDIR_REQUIRED = 8, // 0x8
ADS_UF_LOCKOUT = 16, // 0x10
ADS_UF_PASSWD_NOTREQD = 32, // 0x20
ADS_UF_PASSWD_CANT_CHANGE = 64, // 0x40
ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED = 128, // 0x80
ADS_UF_TEMP_DUPLICATE_ACCOUNT = 256, // 0x100
ADS_UF_NORMAL_ACCOUNT = 512, // 0x200
ADS_UF_INTERDOMAIN_TRUST_ACCOUNT = 2048, // 0x800
ADS_UF_WORKSTATION_TRUST_ACCOUNT = 4096, // 0x1000
ADS_UF_SERVER_TRUST_ACCOUNT = 8192, // 0x2000
ADS_UF_DONT_EXPIRE_PASSWD = 65536, // 0x10000
ADS_UF_MNS_LOGON_ACCOUNT = 131072, // 0x20000
ADS_UF_SMARTCARD_REQUIRED = 262144, // 0x40000
ADS_UF_TRUSTED_FOR_DELEGATION = 524288, // 0x80000
ADS_UF_NOT_DELEGATED = 1048576, // 0x100000
ADS_UF_USE_DES_KEY_ONLY = 2097152, // 0x200000
ADS_UF_DONT_REQUIRE_PREAUTH = 4194304, // 0x400000
ADS_UF_PASSWORD_EXPIRED = 8388608, // 0x800000
ADS_UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION = 16777216 // 0x1000000
}
With this you can write code like:
val = val | (int) UserAccountControl.ADS_UF_DONT_EXPIRE_PASSWD;
Far more readable, I think you’ll agree.
And remember:
To clear a value, use:
val = val & (int) ~UserAccountControl.ADS_UF_ACCOUNTDISABLE;
The ~ is a boolean complement ~ Operator.
Enjoy!
Being doing a bit of work in this space and I found the following links to be really useful:
Howto: (Almost) Everything In Active Directory via C#
Everything in Active Directory via C#.NET 3.5
Active Directory Objects and C#
So if you want to create users, work with their passwords, update their details, add them to groups etc. you’ll find something above to help you.
Enjoy!
Busy doing some AD work with C#.
I’m creating the user, changing some of the attributes (e.g. setting “DONT_EXPIRE_PASSWORD”) and then setting the password.
Got the exception:
DirectoryServicesCOMException (0x80072035): The server is unwilling to process the request
Mr. Google to the rescue. After sorting through the huge pile of crap, found the answer.
You need to do it in the following order:
i.e. Set the password BEFORE doing any attribute CRUD stuff.
Enjoy!
SPN stands for Service Principal Name – used (among others) by Kerberos.
Normally, you work with them via the Setspn tool.
e.g.
setspn –l <account name>
which lists all spns assigned to that account.
However, you can also do this by:
Start – Administrative Tools – Active Directory Users and Computers – View – Advanced Features
Then navigate to the account via the tree. Right click – Properties – Attribute Editor tab. Then scroll down to servicePrincipalName and double-click.
You can add and remove SPN’s from this window as well. (i.e. the equivalent of setspn –a … or setspn –d …).
Enjoy!