通过代码添加 Active Directory 帐户所需的权限

Question

我正在尝试编写一个程序，该程序将使用来自外部数据源的数据自动创建活动目录帐户。我遇到的问题是我总是收到 UnAuthorizedAccessException 但我一生都想不出要应用哪些权限。我什至一直走到根对象并给予我自己的帐户完全控制权，这似乎没有任何区别。我知道我可以访问服务器，因为 OrganizationUnit 和 de 对象已正确填充。

 DirectoryEntry de = new DirectoryEntry("LDAP://MYLOCALADDRESS");            
 de.Password = "thePassword";
 de.Username = "theUserName"; 
 de.AuthenticationType = AuthenticationTypes.Secure ;
 DirectoryEntry organizationalUnit = de.Parent;
 DirectoryEntry newUser = organizationalUnit.Children.Add("TESTADD  ", de.SchemaClassName);

 //Exception happens on this line
 newUser.CommitChanges();

任何帮助将不胜感激！

Answer 1

乍一看，我会说你的“TESTADD”需要以“CN =”开头

对于活动目录，我从这个代码项目：

public string CreateUserAccount(string ldapPath, string userName, 
    string userPassword)
{
    try
    {
        string oGUID = string.Empty;
        string connectionPrefix = "LDAP://" + ldapPath;
        DirectoryEntry dirEntry = new DirectoryEntry(connectionPrefix);
        DirectoryEntry newUser = dirEntry.Children.Add
            ("CN=" + userName, "user");
        newUser.Properties["samAccountName"].Value = userName;
        newUser.CommitChanges();
        oGUID = newUser.Guid.ToString();

        newUser.Invoke("SetPassword", new object[] { userPassword });
        newUser.CommitChanges();
        dirEntry.Close();
        newUser.Close();
    }
    catch (System.DirectoryServices.DirectoryServicesCOMException E)
    {
        //DoSomethingwith --> E.Message.ToString();

    }
    return oGUID;
}