c# - 在具有可分辨名称的 Active Directory 中移动计算机时出现问题

Question

我能够让我的代码中的帐户禁用部分工作，但为了让我们的 AD 树更加干净，我们有一个专门创建的!DisabledOU。我希望我的代码能够禁用计算机帐户并将其移动到!DisabledOU 中。

这是我到目前为止所拥有的：

string computerName = Environment.MachineName;
using (PrincipalContext domainContext = new PrincipalContext(ContextType.Domain, null, "username", "password"))
{
    ComputerPrincipal computer = ComputerPrincipal.FindByIdentity(domainContext, computerName);

    if (computer != null)
    {
       try
       {
          computer.Enabled = false;
          label3.Visible = true;
          computer.Save();
          label3.Text = "Computer was disabled in Active Directory." + "\n";

          try
          {
             string LdapDomain = "prefix.domain.suffix";
             string distinguishedName = string.Empty;
             string connectionPrefix = "LDAP://" + LdapDomain;
             DirectoryEntry entry = new DirectoryEntry(connectionPrefix);

             DirectorySearcher mySearcher = new DirectorySearcher(entry);
             mySearcher.Filter = "(&(objectClass=computer)(|(cn=" + computerName + ")(dn=" + computerName + ")))";

             SearchResult result = mySearcher.FindOne();

             if (result == null)
             {
                label3.Text += ("Unable to locate the distinguishedName for the object " + computerName + " in the " + LdapDomain + " domain." + "\n");                           
             }
             else if (result != null)
             {
                 DirectoryEntry directoryObject = result.GetDirectoryEntry();
                 distinguishedName = "LDAP://" + directoryObject.Properties["distinguishedName"].Value;
                 label3.Text += ("Distinguished name is " + distinguishedName + "\n");

                 string newLocation = "OU=!Disabled,DC=prefix,DC=domain,DC=suffix";
                 DirectoryEntry nLocation = new DirectoryEntry("LDAP://" + newLocation);
                 string newName = directoryObject.Name;

                 //directoryObject.MoveTo(nLocation, newName);

                 DirectoryEntry moveParent = new DirectoryEntry(newLocation);

                 directoryObject.MoveTo(moveParent); //Comes from Microsoft example, as prior may have been possible cause of errors.

                 label3.Text += ("Successfully moved computer to the !Disabled OU");

                 nLocation.Close();
                 directoryObject.Close();

                 entry.Close();
                 entry.Dispose();
                 mySearcher.Dispose();
             }
             else
             {
                 label3.Text += ("Unexpected error in moving computer.");
             }

             button1.Visible = true;
          }
          catch (Exception p)
          {
              label3.Text += ("Failed to move computer with exception " + p);
              button1.Visible = true;
          }

          /*
          public void Move(string objectLocation, string newLocation)
          {
              //For brevity, removed existence checks
              DirectoryEntry eLocation = new DirectoryEntry("LDAP://" + objectLocation);
              DirectoryEntry nLocation = new DirectoryEntry("LDAP://" + newLocation);
              string newName = eLocation.Name;
              eLocation.MoveTo(nLocation, newName);
              nLocation.Close();
              eLocation.Close();
          }
          */
       }
       catch (Exception x)
       {
          label3.Visible = true;
          label3.Text = "Unable to disable computer with exception " + x;
          button1.Visible = true;
       }
    }
    else if (computer == null)
    {
        label3.Visible = true;
        label3.Text = "Computer was not found in Active Directory.";
        button1.Visible = true;
    }
    else
    {
        label3.Visible = true;
        label3.Text = "Unexpected error in computer search.";
        button1.Visible = true;
    }
}

显示方面相当草率，但它是一个快速而肮脏的 Windows 窗体，可以显示所有正在发生的事情。我遇到的问题是，即使我有专有名称并且可以DirectoryEntry从搜索中获取对象，但当我调用该MoveTo()方法时，我会收到有关该对象不存在或未找到的错误。有人可以在这里指出我正确的方向吗？

我考虑过绑定到两个不同的 OU 并使用DirectoryEntry.Children.Add()andDirectoryEntry.Children.Remove()方法作为解决方法，但这并不能解决我在遍历 AD 时遇到的问题。