如何在 ActiveDirectory 中找到当前用户具有 WriteProperty 访问权限的所有组？答案

【问题标题】：How to find all groups in ActiveDirectory where the current user has WriteProperty access?如何在 ActiveDirectory 中找到当前用户具有 WriteProperty 访问权限的所有组？
【发布时间】：2010-05-11 12:26:26
【问题描述】：

目前我想在 Active Directory 中查找当前用户拥有WriteProperty 权限的所有组。

问题是我可以找到直接插入用户的所有组，但是当用户在一个组中并且该组具有写入权限时，它不会显示。我认为设置 GetAccessRules() 的布尔值会有所帮助，但它没有。

所以这是我已经拥有的代码：

var identity = WindowsIdentity.GetCurrent().User;
var allDomains = Forest.GetCurrentForest().Domains.Cast<Domain>();

var allSearcher = allDomains.Select(domain =>
    {
        var searcher = new DirectorySearcher(new DirectoryEntry("LDAP://" + domain.Name));
        //Apply some filter to focus on only some specfic objects
        searcher.Filter = "(&(objectClass=group)(name=*part_of_group_name*))";
        return searcher;
    });

var itemsFound = allSearcher
    .SelectMany(searcher => searcher.FindAll()
        .Cast<SearchResult>()
        .Select(result => result.GetDirectoryEntry()));

var itemsWithWriteAccess = itemsFound
    .Where(entry => entry.ObjectSecurity.GetAccessRules(true, true, typeof(SecurityIdentifier))
        .Cast<ActiveDirectoryAccessRule>()
        .Where(rule => rule.IdentityReference == identity)
        .Where(rule => (rule.ActiveDirectoryRights & ActiveDirectoryRights.WriteProperty) == ActiveDirectoryRights.WriteProperty)
        .Count() > 0);

foreach (var item in itemsWithWriteAccess)
{
    Debug.Print(item.Name);
}

【问题讨论】：

标签： c# linq active-directory

【解决方案1】：

经过很长时间和Harvey 到this question 的帮助，我终于找到了一个很好的解决方案。

正如 Harvey 已经解释的那样，要真正进一步了解您将在entry.Properties["allowedAttributesEffective"].Value 中得到什么可能有点困难。但在正常情况下，您需要检查的所有写入权限是该字段是否只是 not null。

这里是示例代码：

// (replace "part_of_group_name" with some partial group name existing in your AD)
var groupNameContains = "part_of_group_name";

var identity = WindowsIdentity.GetCurrent().User;
var allDomains = Forest.GetCurrentForest().Domains.Cast<Domain>();

var allSearcher = allDomains.Select(domain =>
{
    var searcher = new DirectorySearcher(new DirectoryEntry("LDAP://" + domain.Name));

    // Apply some filter to focus on only some specfic objects
    searcher.Filter = String.Format("(&(objectClass=group)(name=*{0}*))", groupNameContains);
    return searcher;
});

var directoryEntriesFound = allSearcher
    .SelectMany(searcher => searcher.FindAll()
        .Cast<SearchResult>()
        .Select(result => result.GetDirectoryEntry()));

var allowedTo = directoryEntriesFound.Select(entry =>
    {
        using (entry)
        {
            entry.RefreshCache(new string[] { "allowedAttributesEffective" });
            var rights = entry.Properties["allowedAttributesEffective"].Value == null ? "read only" : "write";
            return new { Name = entry.Name, AllowedTo = rights };
        }
    });

foreach (var item in allowedTo)
{
    var message = String.Format("Name = {0}, AllowedTo = {1}", item.Name, item.AllowedTo);
    Debug.Print(message);
}

【讨论】：