ActiveDirectory Local Machine Account management - C#

Question

Hi Guys,

I posted a question re LDAP account management, but after exploring this, it's not what i'm after. I've managed to find two ways of creating users on a machine, and i find one is much neater than the other, however, i am uncertain how to convert the first option over to the second option entirely.

This was my first solution:

        Process MyProc = new Process();
        MyProc.StartInfo.WorkingDirectory = System.Environment.SystemDirectory;
        MyProc.StartInfo.FileName = "net.exe";
        MyProc.StartInfo.UseShellExecute = false;
        MyProc.StartInfo.RedirectStandardError = true;
        MyProc.StartInfo.RedirectStandardInput = true;
        MyProc.StartInfo.RedirectStandardOutput = true;
        MyProc.StartInfo.WindowStyle = ProcessWindowStyle.Hidden;

        MyProc.StartInfo.Arguments = string.Format(@" user {0} {1} /ADD /ACTIVE:YES /EXPIRES:NEVER /FULLNAME:{0}"" /PASSWORDCHG:NO /PASSWORDREQ:YES", username, password);

        MyProc.Start();
        MyProc.WaitForExit();
        int exit = MyProc.ExitCode;

        MyProc.Close();

        return exit == 0;

And this was my second (preffered) solution:

        DirectoryEntry root = GetDELocalRoot();
        DirectoryEntry user = root.Children.Add(username, "user");
        //TODO: Always Active
        //TODO: Never Expires
        //TODO: No Password Change
        //TODO: Password Required
        user.Properties["description"].Value = "Account for running the MicaService and handling updates.";
        user.Invoke("SetPassword", new object[] { password });

        user.CommitChanges();
        user.Close();

I would like to map all the settings in my TODO: from the first solution into my second neater solution.

I have tried the following line as well:

user.Properties["userAccountControl"].Value = ADS_USER_FLAG.ADS_UF_NORMAL_ACCOUNT | ADS_USER_FLAG.ADS_UF_PASSWD_CANT_CHANGE | ADS_USER_FLAG.ADS_UF_DONT_EXPIRE_PASSWD;

But this does not work as the property does not exist in cache.

NOTE: the GetDELocalRoot() = return new DirectoryEntry("WinNT://" + Environment.MachineName);

Thanks for any input!

Regards

Tris

Answer 1

Check out my friend Richard Mueller's web site which has lots of useful information and reference material on what those two providers - WinNT for local machine accounts vs. LDAP for network accounts - have to offer.

There's also a Excel sheeet with all attributes that the WinNT provider exposes - it's a lot less than what the LDAP provider has, so I'm not sure if you'll be able to set all the properties you're looking for.

Marc