System.DirectoryServices - 如何不查询 Active Directory 以获取设置了机密位的属性

发布于 2024-11-28 07:32:31 字数 1050 浏览 1 评论 0原文

我正在使用 DirectoryServices 查询个人或组的 DirectoryEntries，如下所示：

var propsToLoad = new string {"sAMAccountName","objectClass", "memberOf", "distinguishedName", "manager","mail","name","objectCategory"};
DirectoryEntry dEntry = new DirectoryEntry("LDAP://<MyDomainController>/DC=foo,FC=com","user","pass");
DirectorySearcher dSearch = new DirectorySearcher(dEntry, "(&(|(objectClass=person)(objectClass=group))
(samAccountName=jsmith))", propsToLoad);
var searchResult = s.FindOne();
var searchResultDirEntry = result.GetDirectoryEntry();

我遇到的问题是，上述获取 SearchResult 的 DirectoryEntry 的调用是获取比我查询的属性更多的属性。如果我在调试时将鼠标悬停在 searchResult 上，它只包含我查询的 8 个属性，但在 searchResult 查询上调用 "GetDirectoryEntry()"更多属性（大约 77 - 80 个属性值）。

真正的问题是它还在查询设置了“机密位”的属性，例如'UnixUserPassword' 导致 DC 审核失败。

有没有办法指定不查询任何设置了机密位的属性或尊重 result.GetDirectoryEntry(); 我的“propsToLoad”，并且仅获取我在 DirectorySearcher 上指定的属性的属性值。

原文

I'm using DirectoryServices to query for DirectoryEntries for a person or group like so:

var propsToLoad = new string {"sAMAccountName","objectClass", "memberOf", "distinguishedName", "manager","mail","name","objectCategory"};
DirectoryEntry dEntry = new DirectoryEntry("LDAP://<MyDomainController>/DC=foo,FC=com","user","pass");
DirectorySearcher dSearch = new DirectorySearcher(dEntry, "(&(|(objectClass=person)(objectClass=group))
(samAccountName=jsmith))", propsToLoad);
var searchResult = s.FindOne();
var searchResultDirEntry = result.GetDirectoryEntry();

The issue I'm having is that the above call for getting the DirectoryEntry for the SearchResult is fetching more properties than what I'm querying for.
If I hover over the searchResult while debugging, it contains just the 8 properties I queried for but calling "GetDirectoryEntry()" on the searchResult queries for a ton more
properties(approx 77 - 80 more property values).

The real problem is that it is also querying for properties whose "confidential bit" is set such as 'UnixUserPassword'
causing audit failures on the DC.

Is there any way to specify NOT to query for any properties having the confidential bit set OR have the result.GetDirectoryEntry(); respect
my "propsToLoad" and only fetch property values for properties that I've specified on the DirectorySearcher.

分享到QQ

分享到微博