1

I have written a utility in C# to report on AD account details for use in access management processes. I have noticed that the values of some attributes are not included in the reports for accounts which have never logged on, and therefore the userAccountControl hasn't initialised.

Is there a way of programmatically reporting these values for accounts that have never logged in, using C#?

For example, all of our accounts have the employeeType attribute, and on each account employeeType is set to a value of "Contractor" or "Permanent" which is visible in AD Explorer on the account profile's 'Attribute Editor' tab. If the account has been logged into this value is included in my reports, but if it hasn't then employeeType doesn't appear in the results for that account.

Here's a sample of my code:

public static List<ADObjects> getADUserObjects(string domainShortNameStr)
{
    List<ADObjects> adUserObjectsList = new List<ADObjects>();
    DirectoryEntry searchRoot = ADUtils.getSingleDomainDirectoryEntry(domainShortNameStr);
    string searchFilter = "(sAMAccountType=805306368)";
    string[] adAttributeNamesStrArr = new string[] {
        "distinguishedName",
        "sAMAccountName",
        "userAccountControl",
        "employeeType"
    };
    DirectorySearcher search = new DirectorySearcher(searchRoot, searchFilter, adAttributeNamesStrArr);
    search.PageSize = 1000;

    SearchResult result;
    SearchResultCollection resultCol = search.FindAll();
    if (resultCol != null)
    {
        for (int counter = 0; counter < resultCol.Count; counter++)
        {
            result = resultCol[counter];
            ADObjects tempAdUserObject = new ADObjects();
            tempAdUserObject.DistinguishedName = (result.Properties.Contains("distinguishedName")) ? ((String)result.Properties["distinguishedName"][0]) : null;
            tempAdUserObject.SAMAccountName = (result.Properties.Contains("samaccountname")) ? (String)result.Properties["samaccountname"][0] : null;
            tempAdUserObject.UserAccountControl = (result.Properties.Contains("userAccountControl")) ? result.Properties["userAccountControl"][0].ToString() : null;
            tempAdUserObject.EmployeeType = (result.Properties.Contains("employeeType")) ? (String)result.Properties["employeeType"][0] : null;
            adUserObjectsList.Add(tempAdUserObject);
        }
    }
    ...
    return adUserObjectsList;
}

I have tried running similar reports using CSVDE, LDIFDE, DSQUERY, Powershell and VBScript and the same thing happens: the employeeType isn't returned for accounts that have never logged in.

All reports have been run under both my own domain account, and a read-only service account created for this purpose, producing the same results.

6
  • You forgot to include if the attribute is actually present on the accounts.
    – Greg Askew
    May 18, 2017 at 12:28
  • Thanks Greg. I have reworded that section to (hopefully) make it clearer!
    – LupusAlbus
    May 18, 2017 at 12:59
  • The required information still is not provided. If you inspect the account in AD Users and Computers, does the employeeType attribute have a value for accounts that are report a null value in code or not?
    – Greg Askew
    May 18, 2017 at 13:02
  • Edited again. Yes, all accounts have the employeeType attribute set to a value on the domain, and that is visible in MS AD Explorer. Whether the employeeType appears in the report depends on whether the account has been logged into.
    – LupusAlbus
    May 18, 2017 at 13:24
  • Why do you say userAccountControl is not initialised? userAccountControl is a required attribute. If I create an account, userAccountControl is present as with any other account.
    – Greg Askew
    May 18, 2017 at 13:44

1 Answer 1

0

If the attribute is not set in the LDAP entries until the first log in, then there is no LDAP query which will return it. It's the way the LDAP protocol works :

If the attribute is not set in the entry, even if it is requested, it won't be empty in the result, but there will not be the attribute at all.

You will have to test in your entry processing that if the entry attribute "EmployeeType" is not present, then set a default value that you want to appear in the report

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .