LDAP Directory Entry in .Net - not working with OU=Users

Question

Hi Guys. I have the following code (C#):

(Tweaked from: http://www.eggheadcafe.com/conversation.aspx?messageid=31766061&threadid=31766050)

        DirectorySearcher dseSearcher = new DirectorySearcher();

        string rootDSE = dseSearcher.SearchRoot.Path;
        DirectoryEntry rootDE = new DirectoryEntry(rootDSE);

        string userDSE = rootDSE.Insert(7, "OU=Users,");
        DirectoryEntry userDE = new DirectoryEntry(userDSE);

The rootDSE is created correctly, however, the user userDSE is unusable and throws "There is no such object on the server" exception if i attempt to use it.

The LDAP strings are as follows:

Root: LDAP://DC=company,DC=local

User: LDAP://OU=Users,DC=company,DC=local

I'm running on Vista as Admin, but need this to work on XP (Admin) as well.

I'm new to LDAP and Directory Management, so i'm stumbling around in the dark here. Any thoughts? Also - any articles to link too that could give me some insight into how it all works would be appreciated.

Regards

Answer 1

The first thing I would try as a test is to hardcode your desired path when you create a directory entry like so:

DirectoryEntry de = new DirectoryEntry("LDAP://OU=Users,DC=company,DC=local");

This will tell you pretty quick if this is an actual path in your Active Directory. I don't know what your AD looks like so I can't tell you if this is a valid path or not. Under your Active Directory Users and Computers MMC plugin, if this path is correct, then you should have your root domain, and a OU folder under the root called Users.

Paths are generated backwards in AD, so if your Users folder is under another OU off the root than it would be

DirectoryEntry de = new DirectoryEntry("LDAP://OU=Users,OU=<first OU folder>,DC=company,DC=local");

So your AD schema would look like:

 Root 
 |
 --><first OU folder>
     |
     -->Users

A great article on how to manage Active Directory in .NET:

HowTo: Do (Almost) Everything in Active Directory via C#

You might also want to research the System.DirectoryServices, System.DirectoryServices.ActiveDirectory, and the System.DirectoryServices.AccountManagement namespaces provided in the .Net 3.5 Framework. I believe System.DirectoryServices, and ActiveDirctory namespaces were available staring in .Net 1.1, and AccountManagement was introduced in .Net 3.5.

Microsoft Documentation - A lot of good links on how to use the namespace

Addendum:

To actually find a user in AD you will want to do the following:

 DirectoryEntry de = new DirectoryEntry();
 de.Path = "LDAP://DC=company,DC=local";
 de.AuthenticationType = AuthenticationTypes.Secure;

 DirectorySearcher deSearch = new DirectorySearcher();

 deSearch.SearchRoot = de;
 deSearch.Filter = "(&(objectClass=user) (cn=" + username + "))";

 SearchResult result = deSearch.FindOne();

 if (result != null)
 {
     DirectoryEntry deUser = new DirectoryEntry(result.Path);
     ... do what ever you need to the deUser
     deUser.Close();
 }

Answer 2

This may seem silly and stupid, but the default tree setup in Active Directory is not OU=Users,dc=domain,dc=com but rather cn=Users,dc=domain,dc=com (Note the CN= not the OU= for Users.

It seems stupid since a container object (objectClass of cn) in AD cannot be a recipient of group policy, but for reasons I do not understand, that is the default.

Gets almost everybody I meet, first time they try to LDAP bind/auth to AD.

Answer 3

As geoffc mentioned correctly, in Active Directory the "Users" under the domain is a container object rather than organizational unit object. This results in a totally different LDAP path which is why you get the error message.

Try the following code and post if it fixes your issue:

// Replace the "company" and "com" with actual domain values...
DirectoryEntry de = new DirectoryEntry("LDAP://CN=Users,DC=company,DC=com");
DirectorySearcher deSearch = new DirectorySearcher();
deSearch.SearchRoot = de;

// Set your other search params here