Active Directory: Directory Searcher returns byte array instead of long (extrememly rare occurances)

Question

Hi,

I'm dealing with importing records from Active Directory and I've had an issue come up a couple of times but as such it's not reproducable.

With using the DirectorySearcher class, in some occurances attribute values are being returned as a byte array instead of a long (the searcher handles the translation from IADsLargeInteger). It may affect other attribute types too but is most certainly happening for longs.

Once it starts happening, it keeps happening until the program is restarted. And then it might be working ok for many months after, so since it's very uncommon, I don't have a lot of information to go on and cannot reproduce it but would like to work around it.

Just wondering if anyone has come across something like this before?

Rough code being used is:

using var searchAttributes = new DirectorySearcher
{
	SearchRoot = directoryEntry,
	Filter = filter,
	PageSize = 1000,
	CacheResults = false,
};

searchAttributes.PropertiesToLoad.AddRange(...); // Various properties here
searchAttributes.PropertiesToLoad.Add("uSNChanged");

using SearchResultCollection src = searchAttributes.FindAll();

foreach (SearchResult sr in src)
{
	// This works like 99% of the time, but sometimes it fails as it's returning a byte[] not a long
	long usnChanged = (long)sr.Properties["uSNChanged"][0]
		
	...
}

Answer 1

Hello Matthew,

The "technique" proposed by Viorel (be ready to convert the byte array to a number) is probably the best pragmatic approach to the problem, but you might find that the byte array is a UTF-8 encoding of a decimal representation of the number rather than 8 bytes in little-endian order.

A possible cause of the problem is the schema caching mechanism used by IADs. The results of a search do not include type information, but the attribute IDs of the properties in the results can be used to look up type information in the schema; rather than querying the schema via LDAP for each result value, the schema is queried once and cached locally. Perhaps are you occasionally experiencing a hitch in this process. One could try to troubleshoot this behaviour by monitoring LDAP, file system and registry activity but, given that the event is rare and the troubleshooting time and know-how intensive, it is probably better to just take the pragmatic approach.

Reference: ADSI LDAP Provider Schema Cache

Gary

Answer 2

Hello there,

AD is using LDAPv3 encoding the values using UTF8, the solution mentioned in the link above might work for you:

if (result.Properties["sAMAccountName"][0].GetType().IsArray)
{
    name = System.Text.Encoding.UTF8.GetString((byte[])result.Properties["sAMAccountName"][0]);
}
else
{
    name = result.Properties["sAMAccountName"][0].ToString();

Similar discussion here https://social.msdn.microsoft.com/Forums/en-US/78cf7ef0-5bd3-452f-bf39-6507ba0a9bf3/ldap-directoryentry-searchresult-returns-data-differently-in-windows-8-than-win7?forum=aspactivedirectory

Hope this resolves your Query !!

--If the reply is helpful, please Upvote and Accept it as an answer--