获得Active Directory组成员，并检查是否已启用或禁用 [英] Get members of Active Directory Group and check if they are enabled or disabled

问题描述

什么是让所有成员的列表的最快方法/用户在给定的AD组，并确定用户是否启用（或禁用）？

What is the fastest way to get a list of all members/users in a given AD group and determine whether or not a user is enabled (or disabled)?

我们可能谈论20K用户，所以我想，以避免击中AD为每个用户。

We are potentially talking about 20K users, so I would like to avoid hitting the AD for each individual user.

推荐答案

如果你在.NET 3.5及以上，你应该看看 System.DirectoryServices.AccountManagement （S.DS.AM）命名空间。阅读所有关于它的：

If you're on .NET 3.5 and up, you should check out the System.DirectoryServices.AccountManagement (S.DS.AM) namespace. Read all about it here:

• 在.NET Framework管理目录安全主体3.5
• 上System.DirectoryServices.AccountManagement MSDN文档

• Managing Directory Security Principals in the .NET Framework 3.5
• MSDN docs on System.DirectoryServices.AccountManagement

基本上，你可以定义域范围内，并很容易地找到在AD用户和/或组：

Basically, you can define a domain context and easily find users and/or groups in AD:

// set up domain context
PrincipalContext ctx = new PrincipalContext(ContextType.Domain);

// find the group in question
GroupPrincipal group = GroupPrincipal.FindByIdentity(ctx, "YourGroupNameHere");

// if found....
if (group != null)
{
   // iterate over members
   foreach (Principal p in group.GetMembers())
   {
      Console.WriteLine("{0}: {1}", p.StructuralObjectClass, p.DisplayName);

      // do whatever you need to do to those members
      UserPrincipal theUser = p as UserPrincipal;

      if(theUser != null)
      {
          if(theUser.IsAccountLockedOut()) 
          {
               ...
          }
          else
          {
               ...
          }
      }
   }
}

新S.DS.AM使得它可以很容易地玩弄用户和组AD！

The new S.DS.AM makes it really easy to play around with users and groups in AD!

这篇关于获得Active Directory组成员，并检查是否已启用或禁用的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！