Creating a user using Active Directory

[elziko]

Hi,

I'm using the following code to create a user:

Dim strNodeName As String = "test user"
Dim NewUser As DirectoryEntry
Dim AD As New DirectoryEntry( "WinNT://MYCOMPUTER")

'delete user when existing
Try
NewUser = AD.Children.Fin d(strNodeName, "User")
AD.Children.Rem ove(NewUser)
'catch 'not found' exception
Catch comEx As COMException
Console.WriteLi ne(comEx.Messag e)
End Try

'add user using the user schema
NewUser = AD.Children.Add (strNodeName, "user")
NewUser.Propert ies("descriptio n").Add("tes t user")

'set user flags, sets normal user and pwd cant change
NewUser.Propert ies("userFlags" ).Add(UF_NORMAL _ACCOUNT Or
UF_PASSWD_CANT_ CHANGE)

'invoke native method 'Setpassword; before comitting
NewUser.Invoke( "SetPasswor d", New Object() {"mysecret"} )
NewUser.CommitC hanges()

'add user toguest alias
Dim grp As DirectoryEntry = AD.Children.Fin d("Administrato rs", "group")
If Not grp.Name Is Nothing Then
grp.Invoke("Add ", New Object() {NewUser.Path.T oString()})
Console.WriteLi ne("Account Created Successfully")
End If

This works fine if I set the domain to be the computer that the code runs on
but if I set it to be our companies domain then I get a
System.Unauthor izedAccessExcep tion. So I when instntiating 'AD' I aslo
passed in the username and password of the administrator on the domain who
is allowed to add users.

I then don;t get an exception, everything runs fine but no user is added to
the local machine, even after reboot. What am I doing wrong?

TIA

[Marc Scheuner [MVP ADSI]]

>Dim strNodeName As String = "test user"

Dim AD As New DirectoryEntry( "WinNT://MYCOMPUTER")
NewUser = AD.Children.Add (strNodeName, "user")
This works fine if I set the domain to be the computer that the code runs on
but if I set it to be our companies domain then I get a
System.Unautho rizedAccessExce ption.

Well, first of all, if you have a "company domain", I would STRONGLY
suggest using the LDAP:// provider rather than the WinNT:// provider.
This WinNT codebae is really only provided as a backwards
compatibility mechanism for NT4 domains, and should be avoided
whenever possible. Also, the WinNT provider does NOT support your
Active Directory hierarchy - you can't create users in specific OU's
(since the WinNT provider only knows about a flat, non-hierarchical
model without OU's).

So I'd suggest using something like:

Dim AD As New DirectoryEntry( "LDAP://cn=Users,dc=You rCOmpany,dc=com ");
Dim NewUser as DirectoryEntry
NewUser = AD.Children.Add ("cn=YourUserNa me", "user");
'' set properties for NewUser, then store them back to AD
NewUser.CommitC hanges();

Secondly, in a corporate domain environment, your default user might
not have permissions to do such things as create a new user - you
possibly need to a) grant your user admin rights (at least on the OU
you're interested in), or b) use another user (and specify it in your
call to "New DirectoryEntry( )".

Also, if you're in an ASP.NET environment, often this "serverless
binding" as mentioned above won't work, and you'd need to specify a
particular DC by machine name which should be used for your binding
operations:

Dim AD As New
DirectoryEntry( "LDAP://DC01.YourCompan .com/cn=Users,dc=You rCOmpany,dc=com ");
HTH
Marc
=============== =============== =============== =============== ====
Marc Scheuner May The Source Be With You!
Berne, Switzerland m.scheuner -at- inova.ch