Active Directory move a user to a different OU

问题

I'm working on a program that will automate the separation process for users leaving our network. One of the tasks it performs is moving the user account from the OU it is in, to a Former Employees OU. I've been having problems with this step even though I've not had any issues doing other processes with DirectoryServices. Here's my code thus far (note: I know I need to stop catching and eating all exceptions. This will be addressed and corrected before release. Any advice on which exceptions I should catch and which I should not would be appreciated too):

private const string AD_DOMAIN_NAME = "domain.com";
private const string AD_NEW_PASSWORD = "TestPassword123";
private const string AD_FORMER_EMPLOYEES_OU = "LDAP://OU=Former Employees,DC=domain,DC=com";

static DirectoryEntry CreateDirectoryEntry(string connectionPath, 
        string adUserName, string adPassword)
{
    DirectoryEntry ldapConnection = null;

    try
    {
        ldapConnection = new DirectoryEntry(AD_DOMAIN_NAME, adUserName, adPassword);
        ldapConnection.Path = connectionPath;
        ldapConnection.AuthenticationType = AuthenticationTypes.Secure;                
    }

    catch (Exception ex)
    {
        MessageBox.Show("Exception Caught in createDirectoryEntry():\n\n" + ex.ToString());
    }

    return ldapConnection;
}

private void btnProcessSeparation_Click(object sender, EventArgs e)
{
    if (cboOffice.SelectedItem != null && lstUsers.SelectedItem != null)
    {
        string userOU = cboOffice.SelectedItem.ToString();
        string userName = lstUsers.SelectedItem.ToString();
        string userDn = "LDAP://OU=" + userOU + ",OU=Employees,DC=domain,DC=com";

        using (DirectoryEntry ldapConnection = CreateDirectoryEntry(userDn))
        {
            using (DirectorySearcher searcher = CreateDirectorySearcher(ldapConnection,
                SearchScope.OneLevel, "(samaccountname=" + userName + ")", "samaccountname"))
            {
                SearchResult result = searcher.FindOne();

                if (result != null)
                {
                    using (DirectoryEntry userEntry = result.GetDirectoryEntry())
                    {
                        if (userEntry != null)
                        {
                            using (DirectoryEntry formerEmployees = CreateDirectoryEntry(
                                AD_FORMER_EMPLOYEES_OU))
                            {
                                userEntry.MoveTo(formerEmployees); // This line throws an DirectoryServicesCOMException.
                            }

                            userEntry.CommitChanges();
                            userEntry.Close();
                            MessageBox.Show("Separation for {0} has completed successfully.", userName);
                        }
                    }
                }
            }
        }
    }

    else
    {
        MessageBox.Show("Error, you did not select an OU or a user. Please try again.");
    }
}

The above code works just fine until the userEntry.MoveTo(formerEmployees); line. That line throws a DirectoryServicesCOMException with the additional information saying An invalid dn syntax has been specified. It is strange because I'm using the same format as the other DirectoryEntry's that work just fine. I've added a break point and confirmed that formerEmployees is set to: LDAP://OU=Former Employees,DC=domain,DC=com. I copied everything after LDAP:// directly from the OU's distinguishedName attribute in Active Directory to make sure it was correct.

Is the space in the OU name causing the problem? I got this to work once just fine and moved on to the other tasks and must have changed something that broke this. I've been looking at the code too much I think and just can't seem to see why it thinks I'm sending an invalid dn.

Thanks for any and all help!

回答1:

Hope this helps:

 DirectoryEntry eLocation = Conexion.Conectar(Localitation);
 DirectoryEntry nLocation =Conexion.Conectar(NewLocalitation);
                        string newName = eLocation.Name;
                        eLocation.MoveTo(nLocation, newName);
                        nLocation.Close();
                        eLocation.Close();

回答2:

After @David pointed me in the right direction of making sure I had the correct permissions to the OU, I discovered the problem. I added an overloaded CreateDirectoryEntry method that uses the username and password (which is what I put in the code above). However, if you notice in the code above, I call the method that only takes the connection path.

Thanks for the help @David!

来源：https://stackoverflow.com/questions/30331727/active-directory-move-a-user-to-a-different-ou

标签

active-directory

directoryservices