在 .NET (C#) 中创建 Active Directory 用户
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/1298449/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Create Active Directory user in .NET (C#)
提问by Paolo Tedesco
I need to create a new user in Active Directory. I have found several examples like the following:
我需要在 Active Directory 中创建一个新用户。我发现了几个类似如下的例子：
using System;
using System.DirectoryServices;
namespace test {
class Program {
static void Main(string[] args) {
try {
string path = "LDAP://OU=x,DC=y,DC=com";
string username = "johndoe";
using (DirectoryEntry ou = new DirectoryEntry(path)) {
DirectoryEntry user = ou.Children.Add("CN=" + username, "user");
user.Properties["sAMAccountName"].Add(username);
ou.CommitChanges();
}
}
catch (Exception exc) {
Console.WriteLine(exc.Message);
}
}
}
}
When I run this code I get no errors, but no new user is created.
当我运行此代码时，我没有收到任何错误，但没有创建新用户。
The account I'm running the test with has sufficient privileges to create a user in the target Organizational Unit.
我用来运行测试的帐户有足够的权限在目标组织单位中创建用户。
Am I missing something (possibly some required attribute of the user object)?
我是否遗漏了什么（可能是用户对象的某些必需属性）？
Any ideas why the code does not give exceptions?
为什么代码不给出异常的任何想法？
EDIT
The following worked for me:
编辑
以下对我有用：
int NORMAL_ACCOUNT = 0x200;
int PWD_NOTREQD = 0x20;
DirectoryEntry user = ou.Children.Add("CN=" + username, "user");
user.Properties["sAMAccountName"].Value = username;
user.Properties["userAccountControl"].Value = NORMAL_ACCOUNT | PWD_NOTREQD;
user.CommitChanges();
So there were actually a couple of problems:
所以实际上有几个问题：
CommitChangesmust be called onuser(thanks Rob)- The password policy was preventing the user to be created (thanks Marc)
CommitChanges必须调用user（感谢 Rob）- 密码策略阻止创建用户（感谢 Marc）
采纳答案by RobV
I think you are calling CommitChanges on the wrong DirectoryEntry. In the MSDN documentation (http://msdn.microsoft.com/en-us/library/system.directoryservices.directoryentries.add.aspx) it states the following (emphasis added by me)
我认为您在错误的 DirectoryEntry 上调用 CommitChanges。在 MSDN 文档（http://msdn.microsoft.com/en-us/library/system.directoryservices.directoryentries.add.aspx）中，它说明了以下内容（我添加的重点）
You must call the CommitChanges method on the new entryto make the creation permanent. When you call this method, you can then set mandatory property values on the new entry. The providers each have different requirements for properties that need to be set before a call to the CommitChanges method is made. If those requirements are not met, the provider might throw an exception. Check with your provider to determine which properties must be set before committing changes.
您必须在新条目上调用 CommitChanges 方法以使创建永久。当您调用此方法时，您可以在新条目上设置必需的属性值。每个提供程序对在调用 CommitChanges 方法之前需要设置的属性都有不同的要求。如果不满足这些要求，提供者可能会抛出异常。在提交更改之前，请咨询您的提供商以确定必须设置哪些属性。
So if you change your code to user.CommitChanges()it should work, if you need to set more properties than just the account name then you should get an exception.
因此，如果您将代码更改为user.CommitChanges()它应该可以工作，如果您需要设置比帐户名称更多的属性，那么您应该会收到异常。
Since you're currently calling CommitChanges() on the OU which hasn't been altered there will be no exceptions.
由于您当前正在未更改的 OU 上调用 CommitChanges()，因此不会有任何例外。
回答by marc_s
Assuming your OU path OU=x,DC=y,DC=comreally exists - it should work :-)
假设您的 OU 路径OU=x,DC=y,DC=com确实存在 - 它应该可以工作:-)
Things to check:
检查事项：
you're adding a value to the "samAccountName" - why don't you just set its value:
user.Properties["sAMAccountName"].Value = username;
您正在向“samAccountName”添加一个值 - 为什么不设置它的值：
user.Properties["sAMAccountName"].Value = username;
Otherwise you might end up with several samAccountNames - and that won't work.....
否则，您最终可能会得到多个 samAccountNames - 这将不起作用.....
you're not setting the
userAccountControlproperty to anything - try using:user.Properties["userAccountControl"].Value = 512; // normal accountdo you have multiple domain controllers in your org? If you, and you're using this "server-less" binding (not specifying any server in the LDAP path), you could be surprised where the user gets created :-) and it'll take several minutes up to half an hour to synchronize across the whole network
do you have a strict password policy in place? Maybe that's the problem. I recall we used to have to create the user with the "doesn't require password" option first, do a first .CommitChanges(), then create a powerful enough password, set it on the user, and remove that user option.
您没有将该
userAccountControl属性设置为任何内容 - 尝试使用：user.Properties["userAccountControl"].Value = 512; // normal account您的组织中有多个域控制器吗？如果您正在使用这种“无服务器”绑定（未在 LDAP 路径中指定任何服务器），您可能会对创建用户的位置感到惊讶:-) 并且需要几分钟到半小时全网同步
你有严格的密码政策吗？也许这就是问题所在。我记得我们曾经必须首先使用“不需要密码”选项创建用户，首先执行 .CommitChanges()，然后创建一个足够强大的密码，在用户上设置它，然后删除该用户选项。
Marc
马克
回答by kombsh
Check the below code
检查下面的代码
DirectoryEntry ouEntry = new DirectoryEntry("LDAP://OU=TestOU,DC=TestDomain,DC=local");
for (int i = 3; i < 6; i++)
{
try
{
DirectoryEntry childEntry = ouEntry.Children.Add("CN=TestUser" + i, "user");
childEntry.CommitChanges();
ouEntry.CommitChanges();
childEntry.Invoke("SetPassword", new object[] { "password" });
childEntry.CommitChanges();
}
catch (Exception ex)
{
}
}
