Active directory 如何读取userAccountControl

我需要知道账户是否：

• 启用/禁用
• 锁定/解锁
• 密码过期/永不过期
• 密码可以更改/不能更改
• 需要密码/不需要密码

---

从哪个userAccountControl值可以知道帐户是上述帐户之一？

此字段是位掩码。您可以查看以查看各个字段

此字段是位掩码。您可以查看以查看各个字段

此字段是位掩码。您可以查看以查看各个字段

此字段是位掩码。您可以查看以查看各个字段

userAccountControl是Active Directory中包含这些位值的字段。您可以使用LDAP查询，使用Brian在我之前的响应中找到的值，在该字段中查找满足任何条件的帐户。下面是一个检查指定用户是否已禁用的示例

public bool checkDisabled(string domainFQDN, string alias)
{
    bool disabled = false;

    try
    {
        using (DirectoryEntry domainDE = new DirectoryEntry("LDAP://" + domainFQDN, "domain\\cn", "password", AuthenticationTypes.Secure))
        {
            using (DirectorySearcher searcher = new DirectorySearcher(domainDE))
            {
                searcher.Filter = String.Format("(&(objectClass=user)(cn={0})(userAccountControl:1.2.840.113556.1.4.803:=2))", alias);
                disabled = (searcher.FindOne() != null);
            }
        }
    }
    catch (Exception ex)
    {
        EventLog.WriteEntry("source name", MethodBase.GetCurrentMethod().DeclaringType + "." + MethodBase.GetCurrentMethod().Name + "\r\n\r\nUnable to get user's token groups for domain: " + domainFQDN + " user: " + alias + "\r\n\r\n" + ex.Message, EventLogEntryType.Error);
    }

    return disabled;
} 

---

userAccountControl是Active Directory中包含这些位值的字段。您可以使用LDAP查询，使用Brian在我之前的响应中找到的值，在该字段中查找满足任何条件的帐户。下面是一个检查指定用户是否已禁用的示例

public bool checkDisabled(string domainFQDN, string alias)
{
    bool disabled = false;

    try
    {
        using (DirectoryEntry domainDE = new DirectoryEntry("LDAP://" + domainFQDN, "domain\\cn", "password", AuthenticationTypes.Secure))
        {
            using (DirectorySearcher searcher = new DirectorySearcher(domainDE))
            {
                searcher.Filter = String.Format("(&(objectClass=user)(cn={0})(userAccountControl:1.2.840.113556.1.4.803:=2))", alias);
                disabled = (searcher.FindOne() != null);
            }
        }
    }
    catch (Exception ex)
    {
        EventLog.WriteEntry("source name", MethodBase.GetCurrentMethod().DeclaringType + "." + MethodBase.GetCurrentMethod().Name + "\r\n\r\nUnable to get user's token groups for domain: " + domainFQDN + " user: " + alias + "\r\n\r\n" + ex.Message, EventLogEntryType.Error);
    }

    return disabled;
} 

---

userAccountControl是Active Directory中包含这些位值的字段。您可以使用LDAP查询，使用Brian在我之前的响应中找到的值，在该字段中查找满足任何条件的帐户。下面是一个检查指定用户是否已禁用的示例

public bool checkDisabled(string domainFQDN, string alias)
{
    bool disabled = false;

    try
    {
        using (DirectoryEntry domainDE = new DirectoryEntry("LDAP://" + domainFQDN, "domain\\cn", "password", AuthenticationTypes.Secure))
        {
            using (DirectorySearcher searcher = new DirectorySearcher(domainDE))
            {
                searcher.Filter = String.Format("(&(objectClass=user)(cn={0})(userAccountControl:1.2.840.113556.1.4.803:=2))", alias);
                disabled = (searcher.FindOne() != null);
            }
        }
    }
    catch (Exception ex)
    {
        EventLog.WriteEntry("source name", MethodBase.GetCurrentMethod().DeclaringType + "." + MethodBase.GetCurrentMethod().Name + "\r\n\r\nUnable to get user's token groups for domain: " + domainFQDN + " user: " + alias + "\r\n\r\n" + ex.Message, EventLogEntryType.Error);
    }

    return disabled;
} 

---

userAccountControl是Active Directory中包含这些位值的字段。您可以使用LDAP查询，使用Brian在我之前的响应中找到的值，在该字段中查找满足任何条件的帐户。下面是一个检查指定用户是否已禁用的示例

public bool checkDisabled(string domainFQDN, string alias)
{
    bool disabled = false;

    try
    {
        using (DirectoryEntry domainDE = new DirectoryEntry("LDAP://" + domainFQDN, "domain\\cn", "password", AuthenticationTypes.Secure))
        {
            using (DirectorySearcher searcher = new DirectorySearcher(domainDE))
            {
                searcher.Filter = String.Format("(&(objectClass=user)(cn={0})(userAccountControl:1.2.840.113556.1.4.803:=2))", alias);
                disabled = (searcher.FindOne() != null);
            }
        }
    }
    catch (Exception ex)
    {
        EventLog.WriteEntry("source name", MethodBase.GetCurrentMethod().DeclaringType + "." + MethodBase.GetCurrentMethod().Name + "\r\n\r\nUnable to get user's token groups for domain: " + domainFQDN + " user: " + alias + "\r\n\r\n" + ex.Message, EventLogEntryType.Error);
    }

    return disabled;
}