通过

管理用户密码

  • 项目

本主题包括有关管理用户密码的信息和代码示例。

下面的 C# 代码示例说明如何通过调用 IADsUser::SetPassword 方法来设置用户密码。有关 IADsUser::SetPassword 的详细信息，请参阅 MSDN Library（网址为 https://go.microsoft.com/fwlink/?LinkID=27252）中的“IADsUser::SetPassword”。

usr.Invoke("SetPassword", SecurelyStoredPassword);

下面的 C# 代码示例说明如何通过调用 IADsUser::ChangePassword 方法更改用户密码。有关 IADsUser::ChangePassword 的详细信息，请参阅 MSDN Library（网址为 https://go.microsoft.com/fwlink/?LinkID=27252）中的“IADsUser::ChangePassword”。

usr.Invoke("ChangePassword", OldSecurelyStoredPassword, NewSecurelyStoredPassword);

下面的 C# 代码示例说明如何设置用户密码以便在下次登录时必须更改它。它将 pwdLastSet 属性设置为 off (-1)。有关 adschema pwdLastSet 属性的详细信息，请参阅 MSDN Library（网址为 https://go.microsoft.com/fwlink/?LinkID=27252）中的“pwdLastSet”或“Pwd-Last-Set attribute（Pwd-Last-Set 属性）”。

usr.Properties["pwdLastSet"].Value = -1; // To turn on, set this value to 0.
usr.CommitChanges();

下面的 Visual Basic .NET 代码示例说明一个设置 ACE 以拒绝用户具有更改其密码的权限的函数。它使用使用 COM Interop 访问 ADSI 访问 IADsSecurityDescriptor 以获取 ntSecurityDescriptor 属性。然后，它使用 IADsAccessControlList 从安全描述符获取 DACL，并使用 IADsAccessControlEntry 获取 AceType、AceFlags、Trustee、Flags、ObjectType 和 AccessMask 属性。AceType 标志在 ADS_ACETYPE_ENUM 中定义。AceFlags 在 ADS_FLAGTYPE_ENUM 中定义。AccessMask 标志在 ADS_RIGHTS_ENUM 中定义。

Imports System
Imports System.DirectoryServices
Imports ActiveDs

Shared Sub DenyChangePassword(User As DirectoryEntry)
    Const PASSWORD_GUID As String = "{ab721a53-1e2f-11d0-9819-00aa0040529b}"
    
    Dim trustees() As String = {"NT AUTHORITY\SELF", "EVERYONE"}
    
    Dim sd As ActiveDs.IADsSecurityDescriptor = CType(User.Properties("ntSecurityDescriptor").Value, 
        ActiveDs.IADsSecurityDescriptor)
    Dim acl As ActiveDs.IADsAccessControlList = CType(sd.DiscretionaryAcl, 
        ActiveDs.IADsAccessControlList)
    Dim ace As New ActiveDs.AccessControlEntry()
    
    Dim trustee As String
    For Each trustee In  trustees
         ace.Trustee = trustee
         ace.AceFlags = 0
         ace.AceType = Fix(ActiveDs.ADS_ACETYPE_ENUM.ADS_ACETYPE_ACCESS_DENIED_OBJECT)
         ace.Flags = Fix(ActiveDs.ADS_FLAGTYPE_ENUM.ADS_FLAG_OBJECT_TYPE_PRESENT)
         ace.ObjectType = PASSWORD_GUID
         ace.AccessMask = Fix(ActiveDs.ADS_RIGHTS_ENUM.ADS_RIGHT_DS_CONTROL_ACCESS)
         acl.AddAce(ace)
    Next trustee
    sd.DiscretionaryAcl = acl
    User.Properties("ntSecurityDescriptor").Value = sd
    User.CommitChanges()
End Sub 'DenyChangePassword

下面的 Visual Basic .NET 示例说明一个设置 ACE 以拒绝用户具有更改其密码的权限的函数。此示例使用 .NET Framework 2.0 中可用的托管 ACL 功能。

Imports System
Imports System.DirectoryServices
Imports System.Security.Principal
Imports System.Security.AccessControl

Sub DenyChangePassword(ByVal user As DirectoryEntry)
    ' Create a Guid that identifies the Change Password right.
    Dim changePasswordGuid As New Guid("{AB721A53-1E2F-11D0-9819-00AA0040529B}")

    ' Get the ActiveDirectorySecurity for the user.
    Dim userSecurity As ActiveDirectorySecurity = user.ObjectSecurity

    ' Create a SecurityIdentifier object for "everyone".
    Dim everyoneSid As New SecurityIdentifier(WellKnownSidType.WorldSid, Nothing)

    ' Create a SecurityIdentifier object for "self".
    Dim selfSid As New SecurityIdentifier(WellKnownSidType.SelfSid, Nothing)

    ' Create an access rule to allow everyone the change password 
    ' right. 
    ' This is used to remove any existing access rules.
    Dim allowEveryone As New ActiveDirectoryAccessRule(everyoneSid, _
        ActiveDirectoryRights.ExtendedRight, _
        AccessControlType.Allow, _
        changePasswordGuid)

    ' Create an access rule to deny everyone the change password right.
    Dim denyEveryone As New ActiveDirectoryAccessRule(everyoneSid, _
        ActiveDirectoryRights.ExtendedRight, _
        AccessControlType.Deny, _
        changePasswordGuid)

    ' Create an access rule to allow self the change password right.
    ' This is used to remove any existing access rules.
    Dim allowSelf As New ActiveDirectoryAccessRule(selfSid, _
        ActiveDirectoryRights.ExtendedRight, _
        AccessControlType.Allow, _
        changePasswordGuid)

    ' Create an access rule to deny self the change password right.
    Dim denySelf As New ActiveDirectoryAccessRule(selfSid, _
        ActiveDirectoryRights.ExtendedRight, _
        AccessControlType.Deny, _
        changePasswordGuid)

    ' Remove any existing rule that gives "everyone" the change 
    ' password right.
    userSecurity.RemoveAccessRuleSpecific(allowEveryone)

    ' Add a new access rule to deny "everyone" the change password 
    ' right.
    userSecurity.AddAccessRule(denyEveryone)

    ' Remove any existing rule that gives "self" the change password 
    ' right.
    userSecurity.RemoveAccessRuleSpecific(allowSelf)

    ' Add a new access rule to deny "self" the change password right.
    userSecurity.AddAccessRule(denySelf)

    ' Commit the changes.
    user.CommitChanges()

End Sub 'DenyChangePassword

下面的 C# 代码示例说明一个设置 ACE 以拒绝用户具有更改其密码的权限的函数。它使用使用 COM Interop 访问 ADSI 访问 IADsSecurityDescriptor 以获取 ntSecurityDescriptor 属性。然后，它使用 IADsAccessControlList 从安全描述符获取 DACL，并使用 IADsAccessControlEntry 获取 AceType、AceFlags、Trustee、Flags、ObjectType 和 AccessMask 属性。AceType 标志在 ADS_ACETYPE_ENUM 中定义。AceFlags 在 ADS_FLAGTYPE_ENUM 中定义。AccessMask 标志在 ADS_RIGHTS_ENUM 中定义。

using System;
using System.DirectoryServices;
using ActiveDs;

static void DenyChangePassword(DirectoryEntry User)
{
    const string PASSWORD_GUID = "{ab721a53-1e2f-11d0-9819-00aa0040529b}";
    const int ADS_UF_PASSWORD_EXPIRED=0x800000;
    const int ADS_UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION=0x1000000;
    string[] trustees = new string[]{@"NT AUTHORITY\SELF","EVERYONE"};

    ActiveDs.IADsSecurityDescriptor sd = (ActiveDs.IADsSecurityDescriptor)
        User.Properties["ntSecurityDescriptor"].Value;
    ActiveDs.IADsAccessControlList acl = (ActiveDs.IADsAccessControlList) sd.DiscretionaryAcl;
    ActiveDs.IADsAccessControlEntry ace = new ActiveDs.AccessControlEntry();

    foreach(string trustee in trustees)
    {
        ace.Trustee = trustee;
        ace.AceFlags = 0;
        ace.AceType = (int)ActiveDs.ADS_ACETYPE_ENUM.ADS_ACETYPE_ACCESS_DENIED_OBJECT;
        ace.Flags = (int)ActiveDs.ADS_FLAGTYPE_ENUM.ADS_FLAG_OBJECT_TYPE_PRESENT;
        ace.ObjectType = PASSWORD_GUID;
        ace.AccessMask = (int)ActiveDs.ADS_RIGHTS_ENUM.ADS_RIGHT_DS_CONTROL_ACCESS;
        acl.AddAce(ace);
    }
    sd.DiscretionaryAcl = acl;
    User.Properties["ntSecurityDescriptor"].Value = sd;
    User.CommitChanges();
}

下面的 C# 示例说明一个设置 ACE 以拒绝用户具有更改其密码的权限的函数。此示例使用 .NET Framework 2.0 中可用的托管 ACL 功能。

using System;
using System.DirectoryServices;
using System.Security.Principal;
using System.Security.AccessControl;

static void DenyChangePassword(DirectoryEntry user)
{
    // Create a Guid that identifies the Change Password right.
    Guid changePasswordGuid = 
        new Guid("{AB721A53-1E2F-11D0-9819-00AA0040529B}");

    // Get the ActiveDirectorySecurity for the user.
    ActiveDirectorySecurity userSecurity = user.ObjectSecurity;

    // Create a SecurityIdentifier object for "everyone".
    SecurityIdentifier everyoneSid = 
        new SecurityIdentifier(WellKnownSidType.WorldSid, null);

    // Create a SecurityIdentifier object for "self".
    SecurityIdentifier selfSid = 
        new SecurityIdentifier(WellKnownSidType.SelfSid, null);

    // Create an access rule to allow everyone the change password 
    // right. 
    // This is used to remove any existing access rules.
    ActiveDirectoryAccessRule allowEveryone = 
        new ActiveDirectoryAccessRule(
            everyoneSid,
            ActiveDirectoryRights.ExtendedRight, 
            AccessControlType.Allow, 
            changePasswordGuid);

    // Create an access rule to deny everyone the change password right.
    ActiveDirectoryAccessRule denyEveryone =
        new ActiveDirectoryAccessRule(
            everyoneSid,
            ActiveDirectoryRights.ExtendedRight,
            AccessControlType.Deny,
            changePasswordGuid);

    // Create an access rule to allow self the change password right.
    // This is used to remove any existing access rules.
    ActiveDirectoryAccessRule allowSelf =
        new ActiveDirectoryAccessRule(
            selfSid,
            ActiveDirectoryRights.ExtendedRight,
            AccessControlType.Allow,
            changePasswordGuid);

    // Create an access rule to deny self the change password right.
    ActiveDirectoryAccessRule denySelf =
        new ActiveDirectoryAccessRule(
            selfSid,
            ActiveDirectoryRights.ExtendedRight,
            AccessControlType.Deny,
            changePasswordGuid);

    // Remove any existing rule that gives "everyone" the change 
    // password right.
    userSecurity.RemoveAccessRuleSpecific(allowEveryone);

    // Add a new access rule to deny "everyone" the change password 
    // right.
    userSecurity.AddAccessRule(denyEveryone);

    // Remove any existing rule that gives "self" the change password 
    // right.
    userSecurity.RemoveAccessRuleSpecific(allowSelf);

    // Add a new access rule to deny "self" the change password right.
    userSecurity.AddAccessRule(denySelf);

    // Commit the changes.
    user.CommitChanges();
}

下面的代码示例说明如何将密码设置为永不过期。它使用 Properties 方法访问 userAccountControl 属性，以设置在 ADS_USER_FLAG_ENUM 中定义的 ADS_UF_DONT_EXPIRE_PASSWD 标志。

Shared Sub DontExpirePassword(User As DirectoryEntry)
    Dim val As Integer
    Const ADS_UF_DONT_EXPIRE_PASSWD As Integer = &H10000
    val = Fix(User.Properties("userAccountControl").Value)
    User.Properties("userAccountControl").Value = val Or ADS_UF_DONT_EXPIRE_PASSWD
    User.CommitChanges()
End Sub 'DontExpirePassword

using System;
using System.DirectoryServices;
using ActiveDs;

static void DontExpirePassword(DirectoryEntry User)
{
    int val;
    const int ADS_UF_DONT_EXPIRE_PASSWD =0x10000;
    val = (int) User.Properties["userAccountControl"].Value;
    User.Properties["userAccountControl"].Value = val | 
        ADS_UF_DONT_EXPIRE_PASSWD;
    User.CommitChanges();
}

另请参见

参考

System.DirectoryServices

概念

用户管理
使用 COM Interop 访问 ADSI

Send comments about this topic to Microsoft.

版权所有 (C) 2007 Microsoft Corporation。保留所有权利。