尝试在 Active Directory 中创建嵌套安全组

发布于 2024-11-25 09:32:26 字数 520 浏览 3 评论 0原文

我正在尝试使用以下代码在活动目录中创建嵌套安全组：

DirectoryEntry newContainer = dirEntry.Children.Add("CN=" + groupName, "group");
newContainer.Properties["description"].Value = groupId;

GrpType gt = GrpType.GlobalGrp | GrpType.SecurityGrp;
int typeNum = (int)gt;

newContainer.Properties["groupType"].Add(typeNum);
newContainer.Properties["sAMAccountName"].Add(groupName);

newContainer.CommitChanges();

创建第一级组时没有问题，但是当我尝试在这些组内创建子安全组时，我得到一个“< strong>命名违规”错误，没有进一步的答案。

顺便说一下，我可以手动创建这些安全组。

原文

I'm trying to create nested security groups in an active directory, with the following code:

DirectoryEntry newContainer = dirEntry.Children.Add("CN=" + groupName, "group");
newContainer.Properties["description"].Value = groupId;

GrpType gt = GrpType.GlobalGrp | GrpType.SecurityGrp;
int typeNum = (int)gt;

newContainer.Properties["groupType"].Add(typeNum);
newContainer.Properties["sAMAccountName"].Add(groupName);

newContainer.CommitChanges();

I get no problem when creating the first level groups, but when I try to create a sub-security group inside these groups, I get a "Naming violation" error, with no further answer.

And by the way, I can manually create those security groups.

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

旧梦荧光笔 2024-12-02 09:32:26

根据您可以在以下位置找到的帮助： Howto: (Almost) Everything In Active Directory via C#

以下是您想要使用 ADSI 执行的操作的示例：

/* Connection to Active Directory
 */
DirectoryEntry deBase = new DirectoryEntry("LDAP://WM2008R2ENT:389/ou=Monou,dc=dom,dc=fr", "user", "password");

/* Group1 creation
 */
DirectoryEntry aGrp1 = deBase.Children.Add("cn=yourGrp1", "group");
aGrp1.Properties["description"].Value = "The description you want";
aGrp1.Properties["groupType"].Add(ADS_GROUP_TYPE_ENUM.ADS_GROUP_TYPE_GLOBAL_GROUP | ADS_GROUP_TYPE_ENUM.ADS_GROUP_TYPE_SECURITY_ENABLED);
aGrp1.Properties["sAMAccountName"].Add("yourGrp1");
aGrp1.CommitChanges();

/* Group2 creation
 */
DirectoryEntry aGrp2 = deBase.Children.Add("cn=yourGrp2", "group");
aGrp2.Properties["description"].Value = "The description you want";
aGrp2.Properties["groupType"].Add(ADS_GROUP_TYPE_ENUM.ADS_GROUP_TYPE_GLOBAL_GROUP | ADS_GROUP_TYPE_ENUM.ADS_GROUP_TYPE_SECURITY_ENABLED);
aGrp2.Properties["sAMAccountName"].Add("yourGrp2");
aGrp2.CommitChanges();

/* Group2 MemberOf Group1
 */
aGrp1.Properties["Member"].Add(aGrp2.Properties["distinguishedName"].Value);
aGrp1.CommitChanges();

使用安全主体随 Framework .NET 3.5 一起引入可以以最短的方式做同样的事情，请参阅：管理 .NET Framework 3.5 中的目录安全主体

According to the help you can find in : Howto: (Almost) Everything In Active Directory via C#

Here is an example of what you want to do whith ADSI :

/* Connection to Active Directory
 */
DirectoryEntry deBase = new DirectoryEntry("LDAP://WM2008R2ENT:389/ou=Monou,dc=dom,dc=fr", "user", "password");

/* Group1 creation
 */
DirectoryEntry aGrp1 = deBase.Children.Add("cn=yourGrp1", "group");
aGrp1.Properties["description"].Value = "The description you want";
aGrp1.Properties["groupType"].Add(ADS_GROUP_TYPE_ENUM.ADS_GROUP_TYPE_GLOBAL_GROUP | ADS_GROUP_TYPE_ENUM.ADS_GROUP_TYPE_SECURITY_ENABLED);
aGrp1.Properties["sAMAccountName"].Add("yourGrp1");
aGrp1.CommitChanges();

/* Group2 creation
 */
DirectoryEntry aGrp2 = deBase.Children.Add("cn=yourGrp2", "group");
aGrp2.Properties["description"].Value = "The description you want";
aGrp2.Properties["groupType"].Add(ADS_GROUP_TYPE_ENUM.ADS_GROUP_TYPE_GLOBAL_GROUP | ADS_GROUP_TYPE_ENUM.ADS_GROUP_TYPE_SECURITY_ENABLED);
aGrp2.Properties["sAMAccountName"].Add("yourGrp2");
aGrp2.CommitChanges();

/* Group2 MemberOf Group1
 */
aGrp1.Properties["Member"].Add(aGrp2.Properties["distinguishedName"].Value);
aGrp1.CommitChanges();

With Security Principals introduced with Framework .NET 3.5 you can do the same thing in a shortest way see : Managing Directory Security Principals in the .NET Framework 3.5

回复收藏 0 原文