通过IP地址选择域控制器C#

Question

以下是在 AD 中创建用户的简单代码。该代码是 DC 非特定的。它不关心它在哪个 DC 上创建它，它会使用服务器连接到的 windows 默认值。

 using (PrincipalContext pc = new PrincipalContext(ContextType.Domain, Domain, path, ContextOptions.Negotiate, ManagementUsername, ManagementPassword))
                {
                    try
                    {
                        using (UserPrincipal up = new UserPrincipal(pc, username, password, true))
                        {
                            up.GivenName = firstName; up.Surname = lastName; up.DisplayName = firstName + " " + lastName; up.UserPrincipalName = username + "@" + Domain; up.Save();
                        }
                    }
                    catch (PasswordException) { return null; }
                }

问题在于新帐户有一个复制时间（通常域有 15 分钟）。当有人想要在连接到与服务器不同的 DC 的工作站上使用该帐户时，尝试实现按需帐户创建时，这不起作用。他们最终不得不坐在工作站前长达 15 分钟无法登录。

问题： 有没有办法根据客户端 IP 地址连接到 DC 以在该 DC 上创建它？或者有没有办法让所有 DC 上的帐户都可以进行复制？或强制帐户以编程方式复制（基于搜索 SO，我猜不是）。

Answer 1

            Forest adForest = Forest.GetCurrentForest();
            ActiveDirectorySite[] sites = new ActiveDirectorySite[adForest.Sites.Count];
            adForest.Sites.CopyTo(sites, 0);
            List<ActiveDirectorySubnet> subnets = new List<ActiveDirectorySubnet>();
            sites.ToList().ForEach(x =>
            {
                ActiveDirectorySubnet[] subnetTemp = new ActiveDirectorySubnet[x.Subnets.Count];
                x.Subnets.CopyTo(subnetTemp, 0);
                subnets.AddRange(subnetTemp);
            });
            IPAddress address = IPAddress.Parse("IPAddress to look up closest DC");
            var currentSubnet = subnets.Where(x => address.IsInRange(x.Name));
            var location = currentSubnet.First().Site.Name;

            DomainController dc = DomainController.FindOne(new DirectoryContext(DirectoryContextType.Domain, Domain), location);

这将为您提供与拓扑中最接近指定 IP 地址的站点和域关联的 DC。 然后将 DC IP 地址传递给 Principal Context。

              using (PrincipalContext pc = new PrincipalContext(ContextType.Domain, dc.IPAddress, path, ContextOptions.Negotiate, ManagementUsername, ManagementPassword))
                {
                    try
                    {
                        using (UserPrincipal up = new UserPrincipal(pc, username, password, true))
                        {
                            up.GivenName = firstName; up.Surname = lastName; up.DisplayName = firstName + " " + lastName; up.UserPrincipalName = username + "@" + Domain; up.Save();
                        }
                    }
                    catch (PasswordException) { return null; }
                }

并创建一个用户。

注意：IPAddress 函数是通过 github 上的 NetTools IPAddressRange 类及其以下自定义扩展完成的。

/// <summary>
/// All extensions for IPAddress type
/// </summary>
public static class IPAddressExtension
{
    /// <summary>
    /// Determine whether this IP address is part of the range/subnet
    /// </summary>
    /// <param name="range">A range of IPAddresses</param>
    /// <returns></returns>
    public static bool IsInRange(this IPAddress thisIP, IPAddressRange range)
    {
        return range.Contains(thisIP);
    }

    /// <summary>
    /// Determine whether this IP address is part of the range/subnet
    /// </summary>
    /// <param name="range">Can be specified in CIDR/UNI (ex: 192.168.10.0/24) </param>
    /// <returns></returns>
    public static bool IsInRange(this IPAddress thisIP, string rangeIP)
    {
        IPAddressRange range = IPAddressRange.Parse(rangeIP);
        return range.Contains(thisIP);
    }

    /// <summary>
    /// Determine whether this IP address is part of the range/subnet
    /// </summary>
    /// <param name="ipBegin">Beginning IP address of range</param>
    /// <param name="ipEnd">Ending IP address of range</param>
    /// <returns></returns>
    public static bool IsInRange(this IPAddress thisIP, IPAddress ipBegin, IPAddress ipEnd)
    {
        IPAddressRange range = new IPAddressRange(ipBegin, ipEnd);
        return range.Contains(thisIP);
    }
}