I have written a utility in C# to report on AD account details for use in access management processes. I have noticed that the values of some attributes are not included in the reports for accounts which have never logged on, and therefore the userAccountControl hasn't initialised.
Is there a way of programmatically reporting these values for accounts that have never logged in, using C#?
For example, all of our accounts have the employeeType attribute, and on each account employeeType is set to a value of "Contractor" or "Permanent" which is visible in AD Explorer on the account profile's 'Attribute Editor' tab. If the account has been logged into this value is included in my reports, but if it hasn't then employeeType doesn't appear in the results for that account.
Here's a sample of my code:
public static List<ADObjects> getADUserObjects(string domainShortNameStr)
{
List<ADObjects> adUserObjectsList = new List<ADObjects>();
DirectoryEntry searchRoot = ADUtils.getSingleDomainDirectoryEntry(domainShortNameStr);
string searchFilter = "(sAMAccountType=805306368)";
string[] adAttributeNamesStrArr = new string[] {
"distinguishedName",
"sAMAccountName",
"userAccountControl",
"employeeType"
};
DirectorySearcher search = new DirectorySearcher(searchRoot, searchFilter, adAttributeNamesStrArr);
search.PageSize = 1000;
SearchResult result;
SearchResultCollection resultCol = search.FindAll();
if (resultCol != null)
{
for (int counter = 0; counter < resultCol.Count; counter++)
{
result = resultCol[counter];
ADObjects tempAdUserObject = new ADObjects();
tempAdUserObject.DistinguishedName = (result.Properties.Contains("distinguishedName")) ? ((String)result.Properties["distinguishedName"][0]) : null;
tempAdUserObject.SAMAccountName = (result.Properties.Contains("samaccountname")) ? (String)result.Properties["samaccountname"][0] : null;
tempAdUserObject.UserAccountControl = (result.Properties.Contains("userAccountControl")) ? result.Properties["userAccountControl"][0].ToString() : null;
tempAdUserObject.EmployeeType = (result.Properties.Contains("employeeType")) ? (String)result.Properties["employeeType"][0] : null;
adUserObjectsList.Add(tempAdUserObject);
}
}
...
return adUserObjectsList;
}
I have tried running similar reports using CSVDE, LDIFDE, DSQUERY, Powershell and VBScript and the same thing happens: the employeeType isn't returned for accounts that have never logged in.
All reports have been run under both my own domain account, and a read-only service account created for this purpose, producing the same results.