c# - Active Directory 用户密码更改错误

Question

嗨，我正在尝试重置 Active Directory 用户的密码，但出现错误，以下是我的代码：

    public string ChangePassword(string Identity,string OldPassword, string Password)
 {
      string success = "Success";
      try
      {


          DirectoryEntry UserEntry = null;
          DirectoryEntry entry = new DirectoryEntry("LDAP://.../DC=Domain,DC=COM", Identity, OldPassword);

          DirectorySearcher search = new DirectorySearcher(entry);
          SearchResult resultsearch = search.FindOne();
          if (resultsearch == null)
          {
              success = "User Not Found In This Domain";
          }
          else
          {

              success = "find";
              UserEntry = resultsearch.GetDirectoryEntry();
              UserEntry.Username = @"Domain\Administrator";
              UserEntry.Password = "password";
              UserEntry.AuthenticationType = AuthenticationTypes.None;

              if (UserEntry == null)
                  success = "User Not Found In This Domain";
              else
              {
                  try
                  {
                      success = UserEntry.Username.ToString();


    UserEntry.Invoke("ChangePassword", new object[] { OldPassword, Password });
                      UserEntry.CommitChanges();

                  }
                  catch (Exception ex)
                  {
                      success = ex.ToString();
                  }
              }
          }
      }
      catch (Exception ex)
      {
          success = ex.ToString();
      }

所以我在UserEntry.Invoke("ChangePassword", new object[] { OldPassword, Password });中遇到错误 UserEntry.CommitChanges();

错误：

        System.Runtime.InteropServices.COMException (0x80020006): Unknown name.           (Exception from HRESULT: 0x80020006 (DISP_E_UNKNOWNNAME))
        at System.DirectoryServices.DirectoryEntry.Invoke(String methodName, Object[] args)
        at WebService.ChangePassword(String Identity, String OldPassword, String Password) in c:\inetpub\wwwroot\WebSite1\App_Code\WebService.cs:line 370

Answer 1

如果您使用的是 .NET Framework 3.5 或更高版本，下面的代码将解决问题。类定义被省略。

using System.DirectoryServices.AccountManagement;

public static string ChangePassword(string adminUser, string adminPassword,
    string domain, string container, string userName, string newPassword)
{
    try
    {
        PrincipalContext principalContext = 
            new PrincipalContext(ContextType.Domain, domain, container, 
                adminUser, adminPassword);
        UserPrincipal user = UserPrincipal.FindByIdentity(principalContext, userName);
        if (user == null) return "User Not Found In This Domain";

        user.SetPassword(newPassword);
        return user.Name;
    }
    catch (Exception ex)
    {
        return ex.Message;
    }
}

用法：

ChangePassword(@"DOMAIN\Administrator", "password", "DOMAIN",
  "DC=Domain,DC=COM", userName, newPassword);

编辑：为 .NET 2.0 框架添加了一个版本。

.NET 2.0 的更改密码方法：

public static string ChangePassword20(string adminUser, string adminPassword,
    string container, string domainController, string userName, string newPassword)
{
    const AuthenticationTypes authenticationTypes = AuthenticationTypes.Secure |
        AuthenticationTypes.Sealing | AuthenticationTypes.ServerBind;

    DirectoryEntry searchRoot = null;
    DirectorySearcher searcher = null;
    DirectoryEntry userEntry = null;

    try
    {
        searchRoot = new DirectoryEntry(String.Format("LDAP://{0}/{1}", 
            domainController, container), 
            adminUser, adminPassword, authenticationTypes);

        searcher = new DirectorySearcher(searchRoot);
        searcher.Filter = String.Format("sAMAccountName={0}", userName);
        searcher.SearchScope = SearchScope.Subtree;
        searcher.CacheResults = false;

        SearchResult searchResult = searcher.FindOne(); ;
        if (searchResult == null) return "User Not Found In This Domain";

        userEntry = searchResult.GetDirectoryEntry();

        userEntry.Invoke("SetPassword", new object[] { newPassword });
        userEntry.CommitChanges();

        return "New password set";
    }
    catch (Exception ex)
    {
        return ex.ToString();
    }
    finally
    {
        if (userEntry != null) userEntry.Dispose();
        if (searcher != null) searcher.Dispose();
        if (searchRoot != null) searchRoot.Dispose();
    }
}

用法：

ChangePassword20(@"DOMAIN\Administrator", "password", "DC=Domain,DC=COM",
    "domainControllerName", "userName", "newPassword");

Answer 2

一些事情：

• 您不应该在 上设置用户名、密码或 AuthN 类型UserEntry。
• 你的成功=UserEntry.Username...应该是obj foo = UserEntry.NativeObject;。如果通过了，你就有了一个有效的 DE。
• 你不需要在CommitChanges()这里打电话。
• 您将在用户而不是管理员的上下文中调用 ChangePassword。这将正确地通过GetDirectoryEntry()呼叫。