在Active Directory中读取/写入对象的安全属性(与权限委派工作的方式相同)C#

Question

我正在寻找一种方法来读取和设置Windows Server 2008+上Active Directory中对象（OU或用户/计算机）的安全权限。与使用Active Directory向导进行委派的方式相同？我希望能够选择OU并使用"重置密码"权限或创建/管理用户的能力为其分配组？

我怎样才能做到这一点？

Answer 1

因此，这里有一个简单的示例，允许域用户"user1"为OU"ForUser1"中的用户重置密码

/* Connection to Active Directory
 */
DirectoryEntry workingOU = new DirectoryEntry();
workingOU.Options.SecurityMasks = SecurityMasks.Owner | SecurityMasks.Group | SecurityMasks.Dacl | SecurityMasks.Sacl;
workingOU.Path = "LDAP://WM2008R2ENT:389/ou=ForUser1,dc=dom,dc=fr";
/* Retreive Obect security
 */
ActiveDirectorySecurity adsOUSec = workingOU.ObjectSecurity;
/* Ellaborate the user to delegate
 */
NTAccount ntaToDelegate = new NTAccount("dom", "user1");
SecurityIdentifier sidToDelegate = (SecurityIdentifier)ntaToDelegate.Translate (typeof(SecurityIdentifier));
/* Specils Guids
 */
Guid UserForceChangePassword = new Guid("00299570-246d-11d0-a768-00aa006e0529");
Guid userSchemaGuid = new Guid("BF967ABA-0DE6-11D0-A285-00AA003049E2");
Guid pwdLastSetSchemaGuid = new Guid("bf967a0a-0de6-11d0-a285-00aa003049e2");
/* Ellaborate ACEs
 */
ExtendedRightAccessRule erarResetPwd = new ExtendedRightAccessRule(ntaToDelegate, AccessControlType.Allow, UserForceChangePassword, ActiveDirectorySecurityInheritance.Descendents, userSchemaGuid);
PropertyAccessRule parPwdLastSetW = new PropertyAccessRule(ntaToDelegate, AccessControlType.Allow, PropertyAccess.Write, pwdLastSetSchemaGuid, ActiveDirectorySecurityInheritance.Descendents, userSchemaGuid);
PropertyAccessRule parPwdLastSetR = new PropertyAccessRule(ntaToDelegate, AccessControlType.Allow, PropertyAccess.Read, pwdLastSetSchemaGuid, ActiveDirectorySecurityInheritance.Descendents, userSchemaGuid);
adsOUSec.AddAccessRule(erarResetPwd);
adsOUSec.AddAccessRule(parPwdLastSetW);
adsOUSec.AddAccessRule(parPwdLastSetR);
workingOU.CommitChanges();

之后你需要：

查找ExtendedRightAccessRule的位置。

一个查找Active Directory架构属性和类信息的地方。