Check if Active Directory account is locked (WPF C #)

Question

Hello everyone (this is my first post) I have a simple AD code that I pulled from Codeplex http://www.codeproject.com/Articles/18102/Howto-Almost-Everything-In-Active-Directory-via-C ), and I can get all of our end-user information from the specified code. Now I searched and searched and found here interesting code snippets, as well as on the Internet that “is the user blocked?”

I would like to use my code, which I have been using for 2 years, and just add a little more to add to the blocked part ... I would be glad if a text field appeared that gave me my information or checkbox or something that just said "user is blocked" and then I would notify the Exchange team and release the user ...

The code I have is the following:

string eid = this.tbEID.Text; string user = this.tbUserName.Text.ToString(); string path = "PP://dc=ds,dc=SorryCantTellYou,dc=com"; DirectoryEntry de = new DirectoryEntry(path); DirectorySearcher ds = new DirectorySearcher(de); ds.Filter = "(&(objectCategory=person)(sAMAccountName=" + eid + "))"; SearchResultCollection src = ds.FindAll(); //AD results if (src.Count > 0) { if (src[0].Properties.Contains("displayName")) { this.tbUserName.Text = src[0].Properties["displayName"][0].ToString(); } } 

So, if I can figure out how to use the same directory entry and the crawler to show me the account lockout status, which would be awesome .. please help

Answer 1

If you are using .NET 3.5 and above, you should check the System.DirectoryServices.AccountManagement (S.DS.AM) namespace. Read more here:

• Managing directory security principles in the .NET Framework 3.5
• MSDN docs in System.DirectoryServices.AccountManagement

Basically, you can define the context of a domain and easily find users and / or groups in AD:

 // set up domain context PrincipalContext ctx = new PrincipalContext(ContextType.Domain); // find a user UserPrincipal user = UserPrincipal.FindByIdentity(ctx, "SamAccountName"); if(user != null) { string displayName = user.DisplayName; if(user.IsAccountLockedOut()) { // do something here.... } } 

The new S.DS.AM makes it very easy to play with users and groups in AD!