Active Directoy LDAP - Block User Account

Question

What is the preferred way to lock an Active Directory account?

int val = (int)directoryentry.Properties["userAccountControl"].Value; directoryentry.Properties["userAccountControl"].Value = val | 0x0010; 

against.

 directoryentry.InvokeSet("IsAccountLocked", true); 

Is there a better way?

Answer 1

Are you using .NET 3.5 (or can you upgrade to it)?

If so, check out the new System.DirectoryServices.AccountManagement namespace and all it has to offer! An excellent introduction is the MSDN article, "Managing Directory Security Principles," in the .NET Framework 3.5 .

In your case, you need to somehow hold the UserPrincipal , for example.

 PrincipalContext ctx = new PrincipalContext(ContextType.Domain, "YOURDOMAIN"); UserPrincipal me = UserPrincipal.Current; 

and then you have access to a lot of really easy to use properties and methods - for example:

 bool isLockedOut = me.IsAccountLockedOut(); 

and you can unlock a locked account using:

 me.UnlockAccount(); 

MUCH is simpler than plain old System.DirectoryServices stuff!

Answer 2

In fact, you have to perform a bitwise action to set the correct bit to the appropriate value. In the link below you will come across the checkboxes for managing user accounts. Thus, you need to perform the appropriate logical operation against the property in order to lock or unlock the account.

I think you are interested in the following link.

Like (almost) everything in AD

I will add code code code code below.

Here is the code:

 public class AdUser { private int _userAccountControl public bool IsLocked { get { return _userAccountControl & UserAccountControls.Lock } set { if(value) _userAccountControl = _userAccountControl | UserAccountControls.Lock else // Must reverse all the bits in the filter when performing an And operation _userAccountControl = _userAccountControl & ~UserAccountControls.Lock } } public enum UserAccountControls { Lock = 0x10 } } 

Please consider making some changes to this code since I have not tested it. But your code should resemble or something close to it, both to lock and unlock a user account. Sooner or later you will have to go with DirectoryEntry.Properties [] to set it to a value in your object class.

EDIT

What is the preferred way to lock an Active Directory account?

  int val = (int)directoryentry.Properties["userAccountControl"].Value; directoryentry.Properties["userAccountControl"].Value = val | 0x0010; 

against.

  directoryentry.InvokeSet("IsAccountLocked", true); 

In answer to your question that I posed in my editing, I would say that this is the easiest way, at least I know. I prefer, as far as I know, to wrap those functions that I roughly did in my code example, so other programmers do not need to worry about bitwise operations, etc. For them, they manipulate objects.

As for the best path between the two, I think this is basically a matter of preference. If you are having a hard time performing logical operations, this is usually preferred. For comparison, the second option is easier to play with.