Question

I m using the System.DirectoryServices.AccountManagement API to pull a list of groups from AD. These groups all start with the same prefix so it s easy to find them using the prefix and a wildcard. What I d also like to do is just get the groups that have changed since I last checked. I ve subclassed GroupPrincipal to include the whenChanged attribute and I m using that currently, after I pull my full list of groups, to filter the list. What I d like to know is, is it possible to perform an AdvancedFilterSearch on a GroupPrincipal? I realize GroupPrincipal doesn t have an AdvancedFilterSearch property. I m wondering if you add one in a sub-class will PrincipalSearcher use it? If yes, an example would be nice.

Thanks,

Chris McKinnon

Answer 1

仅让自上次检查以来发生变化的团体得到的简短答案是不可能(容易)的。

Every object in AD has an Update Sequence Number attribute associated with them. When a group changes its USN changes. BUT, not always. If you add/remove members to the group the USN does not change. It changes only when you change group name or other simple properties. On top of this, the USN number is unique on a single Domain Controller. So you have to make sure you always connect to the same server.

You can subscribe to changes to AD objects and get notified when they change, but this does not scale.

在我的项目中,我结束了对所有群体每次的询问。这并不像它所健全那样糟糕,因为安普森在预想结果方面实在在是好的,而且它没有非常密集的资源。

友情链接