Question

I want to know if user account enable. I use this code:

  var usersList = new List<DirectoryEntry>();
  DirectoryEntry localMachine = new DirectoryEntry("WinNT://" + computerName + ",Computer", Settings.UserName,Settings.UserPassword);

  DirectoryEntry admGroup = localMachine.Children.Find(Settings.AdministratorsGroup, "group");

   object members = admGroup.Invoke("members", null);

   foreach (object groupMember in (IEnumerable)members)
   {
        DirectoryEntry member = new DirectoryEntry(groupMember);
        var b =  member.Properties["userAccountControl"].Value; // <---- value == null
        usersList.Add(member);
   }

I get all members correctly.
But an error is appeared in member.Properties["userAccountControl"].Value. I know of using System.DirectoryServices.AccountManagement namepsace, but i want to know why this code doesn’t work.

Answer 1

You’re using the WinNT:// provider, which is very limited in its abilities. It doesn’t support many of the usual properties that the full-blown LDAP:// provider has – and I would think that’s probably the reason why this code setting userAccountControl (which is an LDAP attribute, most likely not present and not support on a local user account) doesn’t work.

See Richard Mueller’s article WinNT vs. LDAP for a lot more information on what WinNT:// can do (or cannot do)