ADHelp.cs

using System;
using System.Collections.Generic;
using System.Text;
using System.DirectoryServices;
using System.Security.Principal;
using System.Runtime.InteropServices;
//Download by http://www.codefans.net
namespace UserDLL
{
    sealed class ADHelper
    {
        #region 私有变量
        /// <summary>
        /// homeMTA
        /// </summary>
        private static string homeMTA = ""; //请填写自己的环境变量
        /// <summary>
        /// homeMDB
        /// </summary>
        private static string homeMDB = ""; //请填写自己的环境变量
        /// <summary>
        /// msExchHomeServerName
        /// </summary>
        private static string msExchHomeServerName = ""; //请填写自己的环境变量

        ///<summary>
        /// 域名
        ///</summary>
        //private static string DomainName = "td-tech.net";  //实际
        private static string DomainName = "contoso.com";    //测试用
        /// <summary>
        /// LDAP 地址
        /// </summary>
        private static string LDAPDomain = "DC=net,DC=TD-TECH";
        /// <summary>
        /// LDAP绑定路径
        /// </summary>
           private static string ADPath = "LDAP://Contoso.com";     //测试用
          
        private static string sPrincpleNameTail = "@cinf.com";
        /// <summary>
        /// 登录帐号
        /// </summary>
        private static string ADUser = @"contoso\oa";
        /// <summary>
        /// 登录密码
        /// </summary>
        //private static string ADPassword = "3edc5tgB"; //实际
        private static string ADPassword = "1qaz2wsX";   //测试用
          


        #endregion

        #region 枚举常量
        /// <summary>
        /// 用户登录验证结果
        /// </summary>
        public enum LoginResult
        {
            /// 
            /// 正常登录
            /// 
            LOGIN_USER_OK = 0,
            /// 
            /// 用户不存在
            /// 
            LOGIN_USER_DOESNT_EXIST,
            /// 
            /// 用户帐号被禁用
            /// 
            LOGIN_USER_ACCOUNT_INACTIVE,
            /// 
            /// 用户密码不正确
            /// 
            LOGIN_USER_PASSWORD_INCORRECT
        }
        /// <summary>
        /// 用户属性定义标志
        /// </summary>
        public enum ADS_USER_FLAG_ENUM
        {
            /// 
            /// 登录脚本标志。如果通过 ADSI LDAP 进行读或写操作时，
            /// 该标志失效。如果通过 ADSI WINNT，该标志为只读。
            /// 
            ADS_UF_SCRIPT = 0X0001,
            /// 
            /// 用户帐号禁用标志
            /// 
            ADS_UF_ACCOUNTDISABLE = 0X0002,
            /// 
            /// 主文件夹标志
            /// 
            ADS_UF_HOMEDIR_REQUIRED = 0X0008,
            /// 
            /// 过期标志
            /// 
            ADS_UF_LOCKOUT = 0X0010,
            /// 
            /// 用户密码不是必须的
            /// 
            ADS_UF_PASSWD_NOTREQD = 0X0020,
            /// 
            /// 密码不能更改标志
            /// 
            ADS_UF_PASSWD_CANT_CHANGE = 0X0040,
            /// 
            /// 使用可逆的加密保存密码
            /// 
            ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED = 0X0080,
            /// 
            /// 本地帐号标志
            /// 
            ADS_UF_TEMP_DUPLICATE_ACCOUNT = 0X0100,
            /// 
            /// 普通用户的默认帐号类型
            /// 
            ADS_UF_NORMAL_ACCOUNT = 0X0200,
            /// 
            /// 跨域的信任帐号标志
            /// 
            ADS_UF_INTERDOMAIN_TRUST_ACCOUNT = 0X0800,
            /// 
            /// 工作站信任帐号标志
            /// 
            ADS_UF_WORKSTATION_TRUST_ACCOUNT = 0x1000,
            /// 
            /// 服务器信任帐号标志
            /// 
            ADS_UF_SERVER_TRUST_ACCOUNT = 0X2000,
            /// 
            /// 密码永不过期标志
            /// 
            ADS_UF_DONT_EXPIRE_PASSWD = 0X10000,
            /// 
            /// MNS 帐号标志
            /// 
            ADS_UF_MNS_LOGON_ACCOUNT = 0X20000,
            /// 
            /// 交互式登录必须使用智能卡
            /// 
            ADS_UF_SMARTCARD_REQUIRED = 0X40000,
            /// 
            /// 当设置该标志时，服务帐号（用户或计算机帐号）将通过 Kerberos 委托信任
            /// 
            ADS_UF_TRUSTED_FOR_DELEGATION = 0X80000,
            /// 
            /// 当设置该标志时，即使服务帐号是通过 Kerberos 委托信任的，敏感帐号不能被委托
            /// 
            ADS_UF_NOT_DELEGATED = 0X100000,
            /// 
            /// 此帐号需要 DES 加密类型
            /// 
            ADS_UF_USE_DES_KEY_ONLY = 0X200000,
            /// 
            /// 不要进行 Kerberos 预身份验证
            /// 
            ADS_UF_DONT_REQUIRE_PREAUTH = 0X4000000,
            /// 
            /// 用户密码过期标志
            /// 
            ADS_UF_PASSWORD_EXPIRED = 0X800000,
            /// 
            /// 用户帐号可委托标志
            /// 
            ADS_UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION = 0X1000000

        }
        #endregion

        #region 构造函数
        public ADHelper()
        {
            //
            // System.Environment.UserName 

        }

        /// <summary>
        /// 多联的AD构造函数
        /// </summary>
        /// <param name="sADPath"></param>
        /// <param name="sDomainName"></param>
        /// <param name="sADUser"></param>
        /// <param name="sADUserPWD"></param>
        public ADHelper(string sADPath, string sDomainName, string sADUser, string sADUserPWD)
        {
            ADPath = sADPath;
            DomainName = sDomainName;
            ADUser = sADUser;
            ADPassword = sADUserPWD;
        }
        #endregion

        #region GetDirectoryObject

        /// <summary>
        /// 获得DirectoryEntry对象实例,以管理员登陆AD
        /// </summary>
        /// <returns></returns>
        private static DirectoryEntry GetDirectoryObject()
        {
            DirectoryEntry entry = new DirectoryEntry(ADPath, ADUser, ADPassword, AuthenticationTypes.Secure);
            return entry;
        }

        /// <summary>
        /// 根据指定用户名和密码获得相应DirectoryEntry实体
        /// </summary>
        /// <param name="userName"></param>
        /// <param name="password"></param>
        /// <returns></returns>
        private static DirectoryEntry GetDirectoryObject(string userName, string password)
        {
            DirectoryEntry entry = new DirectoryEntry(ADPath,
                userName, password, AuthenticationTypes.None);
            return entry;
        }

        /// <summary>
        /// i.e. /CN=Users,DC=creditsights, DC=cyberelves, DC=Com
        /// </summary>
        /// <param name="domainReference"></param>
        /// <returns></returns>
        private static DirectoryEntry GetDirectoryObject(string domainReference)
        {
            DirectoryEntry entry = new DirectoryEntry(ADPath + domainReference, ADUser, ADPassword,
                AuthenticationTypes.Secure);
            return entry;
        }

        /// <summary>
        ///  获得以UserName,Password创建的DirectoryEntry
        /// </summary>
        /// <param name="domainReference"></param>
        /// <param name="userName"></param>
        /// <param name="password"></param>
        /// <returns></returns>
        private static DirectoryEntry GetDirectoryObject(string domainReference,
            string userName, string password)
        {
            DirectoryEntry entry = new DirectoryEntry(ADPath + domainReference,
                userName, password, AuthenticationTypes.Secure);
            return entry;
        }

        #endregion

        #region GetDirectoryEntry



        /// <summary>
        /// 根据用户公共名称取得用户的 对象
        /// </summary>
        /// <param name="commonName">用户公共名称</param>
        /// <returns>如果找到该用户，则返回用户的 对象；否则返回 null</returns>
        public static DirectoryEntry GetDirectoryEntry(string commonName)
        {
            DirectoryEntry de = GetDirectoryObject();
            DirectorySearcher deSearch = new DirectorySearcher(de);
            deSearch.Filter = "(&(&(objectCategory=person)(objectClass=user))(cn=" + commonName + "))";
            deSearch.SearchScope = SearchScope.Subtree;
            try
            {
                SearchResult result = deSearch.FindOne();
                de = new DirectoryEntry(result.Path);
                //de.Username = ADUser;
                return de;
            }
            catch
            {
                return null;
            }
        }



        /// <summary>
        /// 根据用户公共名称和密码取得用户的 对象。
        /// </summary>
        /// <param name="commonName">用户公共名称</param>
        /// <param name="password">用户密码</param>
        /// <returns>如果找到该用户，则返回用户的 对象；否则返回 null</returns>
        public static DirectoryEntry GetDirectoryEntry(string commonName, string password)
        {
            DirectoryEntry de = GetDirectoryObject(commonName, password);
            DirectorySearcher deSearch = new DirectorySearcher(de);
            deSearch.Filter = "(&(&(objectCategory=person)(objectClass=user))(cn=" + commonName + "))";
            deSearch.SearchScope = SearchScope.Subtree;
            try
            {
                SearchResult result = deSearch.FindOne();
                de = new DirectoryEntry(result.Path);
                return de;
            }
            catch
            {
                return null;
            }
        }



        /// <summary>
        /// 根据用户帐号称取得用户的 对象
        /// </summary>
        /// <param name="sAMAccountName">用户帐号名</param>
        /// <returns>如果找到该用户，则返回用户的 对象；否则返回 null</returns>
        public static DirectoryEntry GetDirectoryEntryByAccount(string sAMAccountName)
        {
            DirectoryEntry de = GetDirectoryObject(ADUser, ADPassword);
            DirectorySearcher deSearch = new DirectorySearcher(de);
            deSearch.Filter = "(&(&(objectCategory=person)(objectClass=user))(sAMAccountName=" + sAMAccountName + "))";
            deSearch.SearchScope = SearchScope.Subtree;
            try
            {
                SearchResult result = deSearch.FindOne();
                de = new DirectoryEntry(result.Path, ADUser, ADPassword);
                return de;
            }
            catch(Exception ex)
            {
                return null;
            }
        }

        /// <summary>
        /// 根据用户帐号和密码取得用户的 对象
        /// </summary>
        /// <param name="sAMAccountName">用户帐号名</param>
        /// <param name="password">用户密码</param>
        /// <returns>如果找到该用户，则返回用户的 对象；否则返回 null</returns>
        public static DirectoryEntry GetDirectoryEntryByAccount(string sAMAccountName, string password)
        {
            DirectoryEntry de = GetDirectoryEntryByAccount(sAMAccountName);
            if (de != null)
            {
                string commonName = de.Properties["cn"][0].ToString();
                if (GetDirectoryEntry(commonName, password) != null)
                    return GetDirectoryEntry(commonName, password);
                else
                    return null;
            }
            else
            {
                return null;
            }
        }

        /// <summary>
        /// 根据组名取得用户组的 对象
        /// </summary>
        /// <param name="groupName">组名</param>
        /// <returns></returns>
        public static DirectoryEntry GetDirectoryEntryOfGroup(string groupName)
        {
            DirectoryEntry de = GetDirectoryObject();
            DirectorySearcher deSearch = new DirectorySearcher(de);
            deSearch.Filter = "(&(objectClass=group)(cn=" + groupName + "))";
            deSearch.SearchScope = SearchScope.Subtree;
            try
            {
                SearchResult result = deSearch.FindOne();
                de = new DirectoryEntry(result.Path);
                return de;
            }
            catch
            {
                return null;
            }
        }

        #endregion

        #region GetProperty



        /// <summary>
        /// 获得指定 指定属性名对应的值 
        /// </summary>
        /// <param name="de">DirectoryEntry对象，如为用户则为用户的对象，部门则为部门的对象</param>
        /// <param name="propertyName">属性名称</param>
        /// <returns>属性值</returns>
        public static string GetProperty(DirectoryEntry de, string propertyName)
        {
            if (de.Properties.Contains(propertyName))
            {
                return de.Properties[propertyName][0].ToString();
            }
            else
            {
                return string.Empty;
            }
        }

        /// 
        /// 获得指定搜索结果 中指定属性名对应的值
        /// 
        /// 
        /// 属性名称
        /// 属性值
        public static string GetProperty(SearchResult searchResult, string propertyName)
        {
            if (searchResult.Properties.Contains(propertyName))
            {
                return searchResult.Properties[propertyName][0].ToString();
            }
            else
            {
                return string.Empty;
            }
        }

        /// <summary>
        /// 查询制定用户是否是锁定状态
        /// </summary>
        /// <param name="de"></param>
        /// <returns></returns>
        public static bool IsAccountLockOut(DirectoryEntry de )
        {
            return Convert.ToBoolean(de.InvokeGet("IsAccountlocked"));
        }


        #endregion

        #region SetProperty
        /// <summary>
        /// 设置指定 的属性值
        /// </summary>
        /// <param name="de"></param>
        /// <param name="propertyName">属性名称</param>
        /// <param name="propertyValue">属性值</param>
        public static void SetProperty(DirectoryEntry de, string propertyName, string propertyValue)
        {
            if (propertyValue != string.Empty || propertyValue != "" || propertyValue != null)
            {
                if (de.Properties.Contains(propertyName))
                {
                    de.Properties[propertyName][0] = propertyValue;
                }
                else
                {
                    de.Properties[propertyName].Add(propertyValue);
                }
            }
        }

        #endregion

        #region 用户操作

        /// <summary>
        /// 创建带邮箱的用户
        /// </summary>
        /// <param name="CommonName">通用名（displayName,系统中显示的中文名字）</param>
        /// <param name="Account">帐户名（如ycan）</param>
        /// <param name="organizeName">组织单元名（有色院/科技处/信息中心）</param>
        /// <param name="password">密码</param>
        /// <param name="CreateMail">是否创建邮箱</param>
        /// <returns>新建用户的Path 错误则为“”</returns>
        public static string CreateADAccount(
            string CommonName,//CName
            string Account,//EName
            string organizeName,//
            string password,
            bool CreateMail
            )
        {
            //如果Acc存在则返回错误
            if (IsAccExists(Account))
                return "";
            DirectoryEntry entry = null;
            DirectoryEntry user = null;
            string samAccountName = Account;
            try
            {
                entry = new DirectoryEntry(GetOrganizeNamePath(organizeName), ADUser,
                ADPassword, AuthenticationTypes.Secure);

                user = entry.Children.Add("CN=" + CommonName, "user");
                user.Properties["userPrincipalName"].Value = samAccountName + sPrincpleNameTail;
                user.Properties["sAMAccountName"].Add(samAccountName);
                user.Properties["displayName"].Add(CommonName);

                user.CommitChanges();
                user.Invoke("SetPassword", new object[] { password });
                //This enables the new user.

                user.Properties["userAccountControl"].Value = //0x200; //ADS_UF_NORMAL_ACCOUNT
                     ADHelper.ADS_USER_FLAG_ENUM.ADS_UF_NORMAL_ACCOUNT | ADHelper.ADS_USER_FLAG_ENUM.ADS_UF_DONT_EXPIRE_PASSWD;
                user.CommitChanges();
                if (CreateMail)
                {
                    user.Invoke("CreateMailbox", new object[] { homeMDB });
                    user.CommitChanges();
                }
            }
            catch (Exception e)
            {
                try
                {
                    user.DeleteTree();
                }
                catch
                {
                    //return string.Empty;
                }
                throw e;
            }
            return user.Path;
        }


        ///// <summary>
        ///// 启用指定的域账号
        ///// </summary>
        ///// <param name="sAMacc">用户的域账号名称</param>
        //public static void EnableUser(string sAMacc)
        //{
        //    EnableUser( GetDirectoryEntryByAccount(sAMacc));
        //}


        /// <summary>
        /// 启用指定的域账号
        /// </summary>
        /// <param name="sAMacc">用户的域账号名称</param>
        public static bool EnableUser(string sAMacc)
        {
            try
            {
                EnableUser(GetDirectoryEntryByAccount(sAMacc));
                return true;
            }
            catch (Exception ex)
            {
                return false;
            }
        }


        /// <summary>
        /// 启用指定帐户
        /// </summary>
        /// <param name="de"></param>
        public static void EnableUser(DirectoryEntry de)
        {
          
            de.Properties["userAccountControl"][0] =
                ADHelper.ADS_USER_FLAG_ENUM.ADS_UF_NORMAL_ACCOUNT | ADHelper.ADS_USER_FLAG_ENUM.ADS_UF_DONT_EXPIRE_PASSWD;
            de.CommitChanges();
            de.Close();
        }

        /// <summary>
        /// 禁用指定公共名称的用户
        /// </summary>
        /// <param name="commonName">用户公共名称</param>
        public static void DisableUser(string sAMacc)
        {
            DisableUser(GetDirectoryEntryByAccount(sAMacc));
        }

        /// <summary>
        /// 禁用指定的帐户
        /// </summary>
        /// <param name="de"></param>
        public static void DisableUser(DirectoryEntry de)
        {
            //impersonate.BeginImpersonate();
            de.Properties["userAccountControl"][0] =
                ADHelper.ADS_USER_FLAG_ENUM.ADS_UF_NORMAL_ACCOUNT | ADHelper.ADS_USER_FLAG_ENUM.ADS_UF_DONT_EXPIRE_PASSWD | ADHelper.ADS_USER_FLAG_ENUM.ADS_UF_ACCOUNTDISABLE;
            de.CommitChanges();
            //impersonate.StopImpersonate();
            de.Close();
        }


        /// <summary> 
        /// 修改用户密码
        /// </summary>
        /// <param name="commonName">用户公共名称</param>
        /// <param name="oldPassword">旧密码</param>
        /// <param name="newPassword">新密码</param>
        public static void ChangeUserPassword(string commonName, string oldPassword, string newPassword)
        {
            // to-do: 需要解决密码策略问题
            DirectoryEntry oUser = GetDirectoryEntry(commonName);
            oUser.Invoke("ChangePassword", new Object[] { oldPassword, newPassword });
            oUser.Close();
        }

        /// <summary> 
        /// 修改Acc密码
        /// </summary>
        /// <param name="sAMacc">帐户名称</param>
        /// <param name="oldPassword">旧密码</param>
        /// <param name="newPassword">新密码</param>
        /// <returns>是否成功</returns>
        public static bool ChangeAccPassword(string sAMacc, string oldPassword, string newPassword)
        {
            try
            {
                if (IsAccExists(sAMacc))
                {
                    // to-do: 需要解决密码策略问题
                    DirectoryEntry oUser = GetDirectoryEntryByAccount(sAMacc);
                    //oUser.Invoke("ChangePassword", new Object[] { oldPassword, newPassword });
                    oUser.Invoke("SetPassword", new object[] { newPassword });
                    oUser.CommitChanges();
                    oUser.Close();
                    return true;
                }
                else
                    return false;
            }
            catch (Exception)
            {
                return false;
            }

        }



        /// <summary>
        /// 移动用户
        /// </summary>
        /// <param name="user_path">用户Path</param>
        /// <param name="target_path">目标path</param>
        /// <returns></returns>
        public static string MoveUser(string user_path, string target_path)
        {
            DirectoryEntry u = new DirectoryEntry(user_path, ADUser, ADPassword);
            DirectoryEntry t = new DirectoryEntry(target_path, ADUser, ADPassword);
            u.MoveTo(t);
            return u.Path;
        }



        /// <summary>
        /// 重名用户
        /// </summary>
        /// <param name="sAcc"></param>
        /// <param name="newDisplayName"></param>
        /// <returns></returns>
        public static bool RenameUser(string sAcc, string newDisplayName)
        {
            try
            {
                if (IsAccExists(sAcc))
                {
                    DirectoryEntry userEntry = GetDirectoryEntryByAccount(sAcc);
                    //userEntry.Properties["cn"][0] = newDisplayName;
                    userEntry.Properties["displayName"][0] = newDisplayName;

                    userEntry.Rename("CN=" + newDisplayName);
                    userEntry.CommitChanges();
                    userEntry.Dispose();
                    return true;
                }
                else
                    return false;
            }
            catch (Exception)
            {

                return false;
            }
        }

        /// <summary>
        /// 重命名Account
        /// </summary>
        /// <param name="oldAcc">原Acc</param>
        /// <param name="newAcc">新Acc</param>
        /// <returns>成功True，如果已经存在新、老Acc则返回false，错误也返回false</returns>
        public static bool RenameAcc(string oldAcc, string newAcc)
        {
            try
            {
                if (IsAccExists(oldAcc))
                {
                    //不允许同名ACC
                    if (IsAccExists(newAcc))
                        return false;
                    DirectoryEntry userEntry = GetDirectoryEntryByAccount(oldAcc);

                    userEntry.Properties["sAMAccountName"][0] = newAcc;
                    userEntry.CommitChanges();
                    userEntry.Dispose();
                    return true;
                }
                else
                    return false;
            }
            catch (Exception)
            {

                return false;
            }

        }

        public static bool SetUserPassword(string userName, string password)
        {
            try
            {
                if (SetUserPassword(null, null, userName, password))
                    return true;
                else
                    return false;
            }
            catch (Exception ex)
            {
                return false;
            
            }
        }

        public static bool SetUserPassword(string adminName, string adminPassword, string userName, string password)
        {
            adminName = ADUser;
            adminPassword = ADPassword;
            try
            {
                DirectoryEntry userEntry = FindObject(adminName, adminPassword, "user", userName);

                //userEntry.Properties["userAccountControl"].Value = 544;//0x200; 
                //userEntry.CommitChanges();


                userEntry.Properties["pwdLastSet"].Value =0; // To turn on, set this value to 0.
                userEntry.CommitChanges();

                userEntry.Invoke("SetPassword", new object[] { password });
                userEntry.CommitChanges();
                return true;
            }
            catch (Exception ex)
            {
                return false;
            }
           
        }


        /// <summary>
        /// 删除AD账户，使用当前上下文的安全信息，一般用于Windows程序
        /// </summary>
        /// <param name="userName">用户名称</param>
        /// <returns></returns>
        public static bool DeleteADAccount(string Account)
        {
            //DeleteADAccount(null, null, userName);
            if (IsAccExists(Account))
            {
                string AccPath = GetAccPath(Account);
                DetTree(AccPath);
                return true;
            }
            else
                return false;
        }


        /// <summary>
        /// 删除AD账户，使用指定的用户名和密码来模拟，一般用于ASP.NET程序
        /// </summary>
        /// <param name="adminUser">AD管理员用户名，如默认，可以为null</param>
        /// <param name="adminPassword">AD管理员密码，如默认，可以为null</param>
        /// <param name="userName">用户名称</param>
        public static bool DeleteADAccount(string adminUser, string adminPassword, string userName)
        {
            DirectoryEntry user = null;
            DirectoryEntry Container = null;
            try
            {
                adminUser = ADUser;
                adminPassword = ADPassword;
                user = FindObject(adminUser, adminPassword, "user", userName);
                Container = user.Parent;
                Container.Children.Remove(user);
                Container.CommitChanges();
                Container.Dispose();
                user.Dispose();
                return true;

            }
            catch (Exception)
            {
                Container.Dispose();
                user.Dispose();
                return false;
            }

        }


        /// <summary>
        /// 设置用户为解除锁定状态
        /// </summary>
        /// <param name="accountName"></param>
        /// <returns></returns>
        public static bool SetADAccountLocked( string accountName)
        {
            DirectoryEntry user = null;
            DirectoryEntry Container = null;
            try
            {

                user = FindObject(ADUser, ADPassword, "user", accountName);
                user.Properties["LockOutTime"].Value = 0; //unlock account
                user.CommitChanges();                     //may not be needed but adding it anyways
                user.InvokeSet("IsAccountLocked", false);
                user.CommitChanges();    
                user.Close();
                return true;
            }
            catch (DirectoryServicesCOMException　ex)
            {
                Container.Dispose();
                user.Dispose();
                return false;
            }

        }


        public static DirectoryEntry FindObject(string category, string name)
        {
            return FindObject(null, null, category, name);
        }

        public static DirectoryEntry FindObject(string adminName,
            string adminPassword, string category, string name)
        {
            adminName = ADUser;
            adminPassword = ADPassword;
            DirectoryEntry de = null;
            //if (adminName == null || adminPassword == null)
            //{
            de = new DirectoryEntry(ADPath, adminName, adminPassword, AuthenticationTypes.Secure);
            //}
            //else
            //{
            //    de = new DirectoryEntry();
            //}
            ///organizationalUnit
            DirectorySearcher ds = new DirectorySearcher(de);
            string queryFilter = string.Format("(&(objectCategory=" +
                category + ")(sAMAccountName={0}))", name);
            ds.Filter = queryFilter;
            ds.Sort.PropertyName = "cn";

            DirectoryEntry userEntry = null;
            try
            {
                SearchResult sr = ds.FindOne();
                userEntry = sr.GetDirectoryEntry();
            }
            finally
            {
                if (de != null)
                {
                    de.Dispose();
                }
                if (ds != null)
                {
                    ds.Dispose();
                }
            }
            return userEntry;
        }

        #endregion

        #region 组织单元操作



        /// <summary>
        /// 重命名OU
        /// </summary>>
        /// <param name="oldOUName">原名</param>
        /// <param name="newOUName">新名</param>
        /// <returns>是否成功</returns>
        public static bool RenameOU(string oldOUName, string newOUName)
        {

            try
            {
                if (CheckOU(oldOUName))
                {
                    DirectoryEntry userEntry = new DirectoryEntry(GetOrganizeNamePath(oldOUName), ADUser, ADPassword);
                    userEntry.Rename("OU=" + newOUName);
                    userEntry.CommitChanges();
                    userEntry.Dispose();
                    if (CheckOU(newOUName))
                        return true;
                    else
                        return false;
                }
                else
                    return false;
            }
            catch (Exception)
            {
                return false;
                //throw;
            }
        }


        /// <summary>
        /// 检查组织单位（OU）是否存在
        /// </summary>
        /// <param name="sOU">组织单位名称 </param>
        /// <returns>成功返回True,否则返回False</returns>
        public static bool CheckOU(string sOU)
        {
            DirectoryEntry objOU = null;
            try
            {
                objOU = new DirectoryEntry(GetOrganizeNamePath(sOU), ADUser, ADPassword);
                string OUName = objOU.Name;
                //if (OUName == sOU)
                objOU.Close();
                objOU = null;
                return true;
            }
            catch
            {
                objOU.Close();
                objOU = null;
                return false;
            }
        }

        /// <summary>
        /// 创建OU，需要指定连接到AD的授权信息
        /// </summary>
        /// <param name="adminName"></param>
        /// <param name="adminPassword"></param>
        /// <param name="name"></param>
        /// <param name="parentOrganizeUnit"></param>
        public static DirectoryEntry CreateOrganizeUnit(string adminName,
            string adminPassword, string name, string parentOrganizeUnit)
        {
            adminName = ADUser;
            adminPassword = ADPassword;
            DirectoryEntry parentEntry = null;
            if (adminName == null || adminPassword == null)
            {
                parentEntry = new DirectoryEntry(GetOrganizeNamePath(parentOrganizeUnit));
            }
            else
            {
                if (parentOrganizeUnit != "")
                {
                    parentEntry = new DirectoryEntry(GetOrganizeNamePath(parentOrganizeUnit),
                       adminName, adminPassword,
                       AuthenticationTypes.Secure);
                }
                else
                {
                    parentEntry = new DirectoryEntry(GetOrganizeNamePath(parentOrganizeUnit),
                         adminName, adminPassword,
                         AuthenticationTypes.Secure);
                }
            }
            DirectoryEntry organizeEntry = parentEntry.Children.Add("OU=" +
                name, "organizationalUnit");
            organizeEntry.CommitChanges();
            return organizeEntry;
        }

        /// <summary>
        /// 创建OU，不需要指定连接到AD的授权信息，用于Windows程序
        /// </summary>
        /// <param name="name">OU name</param>
        /// <param name="parentOrganizeUnit">父OU路径如a/b/c</param>
        public static DirectoryEntry CreateOrganizeUnit(string name, string parentOrganizeUnit)
        {
            return CreateOrganizeUnit(null, null, name, parentOrganizeUnit);
        }

        /// <summary>
        /// 将用户加入到用户组中
        /// </summary>
        /// <param name="userName">用户名</param>
        /// <param name="organizeName">组织名</param>
        /// <param name="groupName">组名</param>
        /// <exception cref="InvalidObjectException">用户名或用户组不存在</exception>
        public static void AddUserToGroup(string userName, string groupName)
        {
            AddUserToGroup(null, null, userName, groupName);
        }

        /// <summary>
        /// 将用户加入到用户组中
        /// </summary>
        /// <param name="adminName"></param>
        /// <param name="adminPassword"></param>
        /// <param name="userName">用户名</param>
        /// <param name="groupName">组名</param>
        /// <exception cref="InvalidObjectException">用户名或用户组不存在</exception>
        public static void AddUserToGroup(string adminName, string adminPassword, string userName, string groupName)
        {
            adminName = ADUser;
            adminPassword = ADPassword;
            DirectoryEntry rootUser = null;
            if (adminName == null || adminPassword == null)
            {
                rootUser = new DirectoryEntry(GetUserPath(), adminName, adminPassword, AuthenticationTypes.Secure);
            }
            else
            {
                rootUser = new DirectoryEntry(GetUserPath());
            }

            DirectoryEntry group = null;
            DirectoryEntry user = null;

            try
            {
                group = rootUser.Children.Find("CN=" + groupName);
            }
            catch (Exception)
            {
                throw new Exception("在域中不存在组“" + groupName + "”");
            }

            try
            {
                user = FindObject(adminName, adminPassword, "user", userName);
            }
            catch (Exception)
            {
                throw new Exception("在域中不存在用户“" + userName + "”");
            }

            //加入用户到用户组中
            group.Properties["member"].Add(user.Properties["distinguishedName"].Value);
            group.CommitChanges();
        }


        /// <summary>
        /// 彻底删除OU/也可以通过参数控制删除空OU,即安全删除
        /// </summary>
        /// <param name="OUName">OU名,如a/b/c,必须写绝对OU名</param>
        /// <param name="boolComplete">true为彻底删除,false为安全删除</param>
        /// <returns>成功与否</returns>
        public static bool DeleteOU(string OUName, bool boolComplete)
        {
            try
            {
                if (!boolComplete)
                    return false;
                if (CheckOU(OUName))
                {
                    string OUpath = GetOrganizeNamePath(OUName);
                    if (OUpath == "")
                        return false;
                    else
                    {
                        DetTree(OUpath);
                        return true;
                    }
                }
                else
                    return true;
            }
            catch (Exception)
            {
                throw;
                //return false;
            }
        }

        /// <summary>
        /// 删除OU（仅仅支持纯部门删除，OU中不能有其他用户、OU等信息的子节点）
        /// </summary>
        /// <param name="OUName">OU名,如a/b/c,必须写绝对OU名</param>
        /// <returns>"成功"  "不存在"  "非空"</returns>
        public static string DeleteOU(string OUName)
        {
            try
            {
                if (CheckOU(OUName))
                {
                    DirectoryEntry objOU = new DirectoryEntry(GetOrganizeNamePath(OUName));
                    DirectoryEntry parOU = objOU.Parent;
                    parOU.Children.Remove(objOU);
                    parOU.CommitChanges();
                    return "成功";
                }
                else
                    return "不存在";
            }
            catch (Exception)
            {
                return "非空";
            }
        }


        #endregion

        #region 登录相关

        /// <summary> 
        /// 判断用户与密码是否足够以满足身份验证进而登录
        /// </summary>
        /// <param name="commonName">用户公共名称</param>
        /// <param name="password">密码</param>
        /// <returns>如能可正常登录，则返回 true；否则返回 false</returns>
        public static LoginResult Login(string commonName, string password)
        {
            DirectoryEntry de = GetDirectoryEntry(commonName);

            if (de != null)
            {
                // 必须在判断用户密码正确前，对帐号激活属性进行判断；否则将出现异常。
                int userAccountControl =
                    Convert.ToInt32(de.Properties["userAccountControl"][0]);
                de.Close();
                if (!IsAccountActive(userAccountControl))

                    return LoginResult.LOGIN_USER_ACCOUNT_INACTIVE;
                if (GetDirectoryEntry(commonName, password) != null)
                    return LoginResult.LOGIN_USER_OK;
                else
                    return LoginResult.LOGIN_USER_PASSWORD_INCORRECT;
            }
            else
            {
                return LoginResult.LOGIN_USER_DOESNT_EXIST;
            }
        }


        /// <summary>
        /// 判断用户帐号与密码是否足够以满足身份验证进而登录
        /// </summary>
        /// <param name="sAMAccountName">用户帐号</param>
        /// <param name="password">密码</param>
        /// <returns>如能可正常登录，则返回 true；否则返回 false</returns>
        public static LoginResult LoginByAccount(string sAMAccountName, string password)
        {
            DirectoryEntry de = GetDirectoryEntryByAccount(sAMAccountName);
            if (de != null)
            {
                // 必须在判断用户密码正确前，对帐号激活属性进行判断；否则将出现异常。
                int userAccountControl =
                    Convert.ToInt32(de.Properties["userAccountControl"][0]);
                de.Close();
                if (!IsAccountActive(userAccountControl))
                    return LoginResult.LOGIN_USER_ACCOUNT_INACTIVE;
                if (GetDirectoryEntryByAccount(sAMAccountName, password) != null)
                    return LoginResult.LOGIN_USER_OK;
                else
                    return LoginResult.LOGIN_USER_PASSWORD_INCORRECT;
            }
            else
            {
                return LoginResult.LOGIN_USER_DOESNT_EXIST;
            }
        }

        /// <summary>
        /// 判断用户帐号是否激活
        /// </summary>
        /// <param name="userAccountControl">用户帐号属性控制器</param>
        /// <returns>如果用户帐号已经激活，返回 true；否则返回 false</returns>
        public static bool IsAccountActive(int userAccountControl)
        {
            int userAccountControl_Disabled =
                Convert.ToInt32(ADS_USER_FLAG_ENUM.ADS_UF_ACCOUNTDISABLE);
            int flagExists = userAccountControl & userAccountControl_Disabled;
            if (flagExists > 0)
                return false;
            else
                return true;
        }

        /// <summary>
        ///  判断用户是否存在
        /// </summary>
        /// <param name="commonName">公用名</param>
        /// <returns></returns>
        public static bool IsUserExists(string commonName)
        {
            DirectoryEntry de = GetDirectoryObject();
            DirectorySearcher deSearch = new DirectorySearcher(de);
            deSearch.Filter = "(&(&(objectCategory=person)(objectClass=user))(cn=" + commonName + "))";       // LDAP 查询串
            SearchResultCollection results = deSearch.FindAll();
            if (results.Count == 0)
                return false;
            else
                return true;
        }
        /// <summary>
        ///  判断帐户是否存在
        /// </summary>
        /// <param name="commonName">Account用户名</param>
        /// <returns>是否存在</returns>
        public static bool IsAccExists(string sAMAccountName)
        {
            DirectoryEntry de = GetDirectoryObject();
            DirectorySearcher deSearch = new DirectorySearcher(de);
            deSearch.Filter = "(&(&(objectCategory=person)(objectClass=user))(sAMAccountName=" +
                sAMAccountName + "))";       // LDAP 查询串
            SearchResultCollection results = deSearch.FindAll();
            if (results.Count == 0)
                return false;
            else
                return true;
        }

        #endregion

        #region 与AD的DN解析有关工具函数

        /// <summary>
        /// 删除对象
        /// </summary>
        /// <param name="path">对象路径</param>
        public static void DetTree(string path)
        {
            try
            {
                DirectoryEntry ent = new DirectoryEntry(path, ADUser, ADPassword);
                ent.DeleteTree();

            }
            catch (Exception e)
            {
                throw e;
            }
        }


        /// <summary>
        /// 获取所有用户所在的安全组
        /// </summary>
        /// <returns></returns>
        private static string GetUserPath()
        {
            return GetUserPath(null);
        }

        /// <summary>
        /// 获取所有没有在AD组织中的用户DN名称
        /// </summary>
        /// <param name="userName"></param>
        /// <returns></returns>
        private static string GetUserPath(string userName)
        {
            StringBuilder sb = new StringBuilder();
            sb.Append(ADPath);
            if (userName != null && userName.Length > 0)
            {
                sb.Append("CN=").Append(userName).Append(",");
            }
            sb.Append("CN=Users,").Append(GetDomainDN());
            return sb.ToString();
        }

        /// <summary>
        /// 根据用户所在的组织结构来构造用户在AD中的DN路径
        /// </summary>
        /// <param name="userName">用户名称</param>
        /// <param name="organzieName">组织结构</param>
        /// <returns></returns>
        public static string GetUserPath(string userName, string organzieName)
        {
            StringBuilder sb = new StringBuilder();
            sb.Append(ADPath);
            sb.Append("CN=").Append(userName).Append(",").Append(SplitOrganizeNameToDN(organzieName));
            return sb.ToString();
        }
        /// <summary>
        /// 获得帐户Acc的Path
        /// </summary>
        /// <param name="sAcc">Acc</param>
        /// <returns>错误就是empty</returns>
        public static string GetAccPath(string sAcc)
        {
            DirectoryEntry de = GetDirectoryObject();
            DirectorySearcher deSearch = new DirectorySearcher(de);
            deSearch.Filter = "(&(&(objectCategory=person)(objectClass=user))(sAMAccountName=" + sAcc + "))";
            deSearch.SearchScope = SearchScope.Subtree;
            try
            {
                SearchResult result = deSearch.FindOne();
                string Apath = result.Path;
                result = null;
                deSearch.Dispose();
                de.Dispose();
                return Apath;
            }
            catch (Exception)
            {
                deSearch.Dispose();
                de.Dispose();
                return string.Empty;
            }
        }

        /// <summary>
        /// 获取域的后缀DN名,如域为cinf.com,则返回"DC=cinf,DC=Com"
        /// </summary>
        /// <returns></returns>
        public static string GetDomainDN()
        {
            return LDAPDomain;
        }
        /// <summary>
        /// 获得OU的Path
        /// </summary>
        /// <param name="organizeUnit">OU名</param>
        /// <returns></returns>
        public static string GetOrganizeNamePath(string organizeUnit)
        {
            StringBuilder sb = new StringBuilder();
            sb.Append(ADPath);//LDAP_IDENTITY
            sb.Append("/");
            return sb.Append(SplitOrganizeNameToDN(organizeUnit)).ToString();
        }

        /// <summary>
        /// 分离组织名称为标准AD的DN名称,各个组织级别以"/"或"\"分开。如"总部/物业公司/小区"，并且当前域为
        /// ExchangeTest.Com，则返回的AD的DN表示名为"OU=小区,OU=物业公司,OU=总 
        /// 部,DC=ExchangeTest,DC=Com"。 
        /// </summary>
        /// <param name="organizeName">组织名称</param>
        /// <returns>返回一个级别</returns>
        public static string SplitOrganizeNameToDN(string organizeName)
        {
            StringBuilder sb = new StringBuilder();

            if (organizeName != null && organizeName.Length > 0)
            {
                string[] allOu = organizeName.Split(new char[] { '/', '\\' });
                for (int i = allOu.Length - 1; i >= 0; i--)
                {
                    string ou = allOu[i];
                    if (sb.Length > 0)
                    {
                        sb.Append(",");
                    }
                    sb.Append("OU=").Append(ou);
                }
            }
            //如果传入了组织名称，则添加,
            if (sb.Length > 0)
            {
                sb.Append(",");
            }
            sb.Append(GetDomainDN());
            return sb.ToString();
        }
        #endregion

        
    }
}