last day (15 days later) » 

10:23 AM
0
Q: Get all users from ActivDirectory?

SnowJimHi, I have the following code : string adServer = ADTestProject.Properties.Settings.Default.Server; string adDomain = ADTestProject.Properties.Settings.Default.Domain; string adUsername = ADTestProject.Properties.Settings.Default.AdiminUsername; string password = ADTestProject....

 
Yes you are correct, haven cleaned the code yet. Thanks
 
Since you haven't mentioned the exact exception you're getting, we can only guess here but perhaps the Name attribute isn't defined on all the objects? You're getting it unconditionally and that would might the issue.
 
I have updated with the exception. I get this(exception) on all 30 items?
 
Thats COM error 0x80004005: Lookup failed. So Name attribute isn't found on any of them (or you can't read it because of permissions) - Have you tried checking with ADSI for the existence of the attribute?
 
Im not sure what you mean? Im fetching all items from the AD and then I try to get extra information about them like name, accountName and so on. When getting that far we know that the item is existing, the question is only to get extra data about the item to be able to display it in nice way.
 
10:23 AM
I just spotted something else. I don't see you specifying PropertiesToLoad anywhere in your code. Are you doing that somewhere before querying for value? Be default only a limited properties are pulled from AD
Hi there
What I meant was, most of the attributes in AD are optional
While they exist in schema, they may not actually be defined & hence queried.
 
Hi, I have just added the top of the method as well
So now there is the whole method
 
sec.. googling
 
It should be easy to create a test project with this method.
 
you may want to use this constructor for DirectorySearcher msdn.microsoft.com/en-us/library/38x105ew
of particular interest is the third parameter
 
But im not using the DirectorySearcher at all?
 
10:29 AM
you can confirm the theory by changing

`treeNode.FullName = memberEntry.Properties["Name"][0].ToString();`
to
`treeNode.FullName = memberEntry.Properties["CN"][0].ToString();`
Umm your code mentions it
the first block?
DirectorySearcher ds = new DirectorySearcher(directoryEntry);
ds.SearchScope = SearchScope.Subtree;
ds.Filter = "(&(objectClass=group))";

objSearchResults = ds.FindAll();
 
Sorry you are right
 
As far as I can see from the given code, you do not explicitly tell AD to give the exact attributes
 
But im still not sure how to fix this problem(new on ActiveDirectory)
I do this : directoryEntry = new DirectoryEntry("LDAP://" + adServer + "/CN=Users," + dcAdDomain, adUsername, password);
 
Yes its tricky. In fact this is the second time we've run into each other :) My last interaction with you was on AD question as well.
ok.. let me cook up something
be back in 10 minutes - doing a sample code on my own AD
 
Haha, I think I posted two AD question and this is the second.
Great!
 
10:33 AM
Yup :) I wasn't sure, so I went to your post history
do you use Linqpad?
 
No I dont?
 
Just asking to know if I can dump my linqpad sample. Really lovely tool for snippets
still trying to reproduce scenario. I don't dig into AD code too often myself >.<
 
Sorry but how do you mean "dump my linqpad sample"?
 
10:48 AM
I'm basically testing by writing snippets in Linqpad (www.linqpad.net)
since it is a snippet, it will reproduce the problem without all the actual code you have. Its just a bit easier if both of us are on same tool. But I'll translate it over to your code once I can reliably reproduce the problem.
 
looking in to the linqpad..
Have to go on lunch now, back soon
 
no problem
 
11:14 AM
treeNode.FullName = memberEntry.Properties["Name"][0].ToString(); <-- is this the only problem line? if you comment this out, can you run it without exceptions?
whenever you come back - I've done the sample and I can't get this to reproduce.. though the code is similar, I am in domain admin mode if that makes a difference?
woo... I think I found it!
 
Im back
I get the exception on alot of the properties
when using watch
What have you found?
 
welcome back. false positive unfortunately I think
 
So when you run it you get no problems?
 
var path = child.ToString().Replace; <- that doesn't look right to me and what does it return?
as in the value and yes I can see sample members
do you use Linq?
var groupsMembers = ds.FindAll().Cast<SearchResult>()
.Select (sr => sr.Properties["member"])
.Select(members => members.Cast<string>())
.Select(dnMembers => dnMembers.Select (dnMember => {
using(var searcher = new DirectorySearcher(new DirectoryEntry(container, username, password), "(distinguishedName="+dnMember+")"))
return searcher.FindOne();
}).Cast<SearchResult>());
that is my sample code that I'm using to pull all the members from groups
where ds is defined as

using(DirectorySearcher ds = new DirectorySearcher(new DirectoryEntry(container, username, password), "(objectClass=group)"))
 
11:31 AM
Aha so you havent tried my code?
the .Repace could be removed
replace
 
this is actually your code in LINQ form
I'm using the result equivilants
right now I'm running into a null reference
 
Aha, but could you not just create a new project at try my code in you enviroment?
 
a group .. with a null member - I dont know how that is happening
is that all standard code?
I'll have to build tree control at least just to get that to compile
ActiveDirectoryTree <-- that seems like a custom class to me
so really hard to do a copy paste
 
Okay I could paste that in to my question as well
 
no its ok
you're GUI is probably not the problem
 
11:36 AM
But the real ploblem is not to fill this ActivDrectory class but to extract the correct information for it.
No the GUI is not the problem
 
if you add anymore code, any other people looking at your question will probably just pass it because of amount of code in there
 
The pasted method is
Thats where the exception is thrown
 
yes and i reduced it to pure active directory function in my linq
 
if you just could create a webform application that runs the method and see how it will react it would probably be esier to solve it.
 
i'll show you the exact extraction code in a second
 
11:37 AM
okay
The problem is when checking the memberEntry properties
thay are throwing the stated exception
instead of giving me the correct information
 
what sort of privilege do you have when extracting the information?
is it possible that you don't have permission to read the attributes from the running context?
for example, if this is running Application Pool identity from a web service account?
 
Im a admin in this domain so that should not be a problem
This is runned in a simple winform application under admin account
local admin
It is runned by my own user I supose
that is admin
But If you could create a sample projekt you would sett fast what the problem is.
 
I actually do know what the problem is. Just dont know the why
 
Okay, I am using the parth for the DirectoryEntry : CN=S-1-5-18,CN=ForeignSecurityPrincipals,DC=myDomain,DC=local does it look correct?
 
if that is the exact path.. then no
LDAP://AD01/CN=S-1...
thats how it should be
so here is how i have "Name" of members extracted
using(DirectorySearcher ds = new DirectorySearcher(new DirectoryEntry(container, username, password), "(objectClass=group)"))
{
var groupsMembers = ds.FindAll().Cast<SearchResult>()
.Select (sr => sr.Properties["member"])
.Select(members => members.Cast<string>())
.Select(dnMembers => dnMembers.AsParallel().Select (dnMember => new DirectoryEntry("LDAP://AD01/" + dnMember, username, password).Properties["name"][0] as string));
groupsMembers.Take(20).Dump();
}
 
11:45 AM
okay so is this correct : LDAP://CN=S-1-5-18/CN=ForeignSecurityPrincipals/DC=MyDomain/DC=local
 
LDAP://ServerName or DomainName/CN=...
oh wait
LDAP://Servername or DomainName/CN=S-1-5-18,CN=ForeignSecurityPrincipals,DC=myDomain,DC=local
 
hmm then the problem is this string then
 
yes
you have invalid path
no property can be retrieved
btw that snippet that I just gave you
it does your codes job exactly and it is working
(browsing all groups - locating their members - translating them to directory entries - returning their names)
 
Dump() is not recognized
 
oh yes ignore that. its linqpad extension method
 
11:52 AM
I get ComeException occured when running your code : Unknown error (0x80005000)
 
lets you see into object like local watch
i wish microsoft would be a little more helpful with those errors - more googling
while I do that, did you try with new LDAP path?
 
This is the hard part with linq, its impossible to know exacly what went wrong in the linq.
 
umm not in linqpad... it tells you exactly where the error is with a blue highlight
but ignoring that, did you by any chance use lowercase LDAP in path string?
it seems to be case sensitive
 
No its correct
And I did try with new LDAP path but no luck
 
ignore my code.. so how have you changed the path and related code exactly (in directory entry)
it is probably something subtle that we're missing out
 
12:01 PM
I have changed it to this : LDAP://CN=S-1-5-18/CN=ForeignSecurityPrincipals/DC=MyDomain/DC=local
 
no thats wrong
the path that you get out of member property, needs to stay as it is
and concatenate it like this: "LDAP://" + servername + "/" + path
where servername is your AD server
or domain name
 
Do you have an example?
 
"LDAP://AD01/" + dnMember
in my code above
dnMember is the CN=... string
as it is.. no replace
so one possible example for your scenario could be

LDAP://myDomain.local/CN=S-1-5-18,CN=ForeignSecurityPrincipals,DC=myDomain,DC=local
I'm assuming you have at least win2k domain
 
Im now using this : LDAP://MyServer/CN=S-1-5-18,CN=ForeignSecurityPrincipals,DC=myDomain,DC=local
The same problem however
 
well your path is fine now at least
 
12:15 PM
The only property that is not throwing an exception is Path
 
ok comment out all properties that you are trying to get and try reading memberEntry.Guid
 
The rest is thowing the directorySErviceCOMException
 
if you can get a Guid out of it, then you are at least connecting and reading the object from AD
yea its the generic AD "go figure" error
 
I get the same exception on the GUID
 
unfortunately we just have to brute force our way through
then there is something else wrong
try with explicit authenticate
authtentication*
var memberEntry = new DirectoryEntry("LDAP://....", username, password)
and see if you can get it then
 
12:18 PM
Yes it does
 
so its down to authentication
whatever account you are using to connect through implicit authentication isn't authorized to query AD for that bit of information
I guess you can leave explicit authentication in for directory entry and you should be able to get other properties
 
hmm okay, then I know
Yes this will be fine!
Thanks alot for the help!
 
you're welcome
not sure how to get an answer out of this now :D
I guess I'll drop a link to this transcript as the answer and the corrective actions we took as summary points
 
hehe, I think that we changed only the var path = "LDAP://" + adServer + "/" + child.ToString();
And using (var memberEntry = new DirectoryEntry(path, adUsername, password))
 
yup
when it comes to AD stuff, the actual code changes are usually minimal but takes hours to figure
 
12:22 PM
thats great, thanks again
yes indeed
 
I'll drop in the answer, if you could please mark it :)
 
yep ofcouse
 
done :)
btw this check isn't needed memberEntry.Username != null && <-- it will return the username you used to authenticate
 
Yes I notice that
The last question now is how to find the top folder. I thought that I could go on ParentId = 000000000 but all the results got a ParentId set so I can´t know where to start building the tree.
 
Umm, sorry how do you mean?
are we still in AD?
your root folder in ad would be LDAP://myDomain.local/dc=myDomain,dc=local
 
12:38 PM
yes, I do now get my list but when building it in a tree I need to know whitch groups to place in the root
All do have parentID so its not clear
I Supose I could do some extra logic to check
if the parentId do not exist in the list then it is to be placed in the root
 
well where exactly are your root groups in AD?
I imagine an OU?
 
Aha, so what I have gotten here might only be a part of a big AD so its possible that the parentID that is stated(the root) falls outside my search
 
yes
 
I understand! Then thanks again.
 
so you have to first define root
 
12:40 PM
Have a nice day! And I will look in to the LinqPad some more.
 
build a directoryentry out of it and get its guid
 
Yes
 
and then just compare to that to know where you are
you're welcome
have a nice day as well and linqpad is a gem .. every developer should have it :)
its really powerful once unlocked with autocompletes - I tend to do most of my prototyping in linq pad before i start a full blown project
you'll love .Dump() in it
over and out :)
 

last day (15 days later) »