c# - 如何找到当前用户具有 WriteProperty 访问权限的 ActiveDirectory 中的所有组？

Question

目前我想在 Active Directory 中找到当前用户拥有权限的所有组 WriteProperty .

问题是我可以找到直接插入用户的所有组，但是当用户在一个组中并且该组具有写入权限时，它不会显示。我认为设置 GetAccessRules() 的 bool 值在这里会有所帮助，但事实并非如此。

这是我已有的代码:

var identity = WindowsIdentity.GetCurrent().User;
var allDomains = Forest.GetCurrentForest().Domains.Cast<Domain>();

var allSearcher = allDomains.Select(domain =>
    {
        var searcher = new DirectorySearcher(new DirectoryEntry("LDAP://" + domain.Name));
        //Apply some filter to focus on only some specfic objects
        searcher.Filter = "(&(objectClass=group)(name=*part_of_group_name*))";
        return searcher;
    });

var itemsFound = allSearcher
    .SelectMany(searcher => searcher.FindAll()
        .Cast<SearchResult>()
        .Select(result => result.GetDirectoryEntry()));

var itemsWithWriteAccess = itemsFound
    .Where(entry => entry.ObjectSecurity.GetAccessRules(true, true, typeof(SecurityIdentifier))
        .Cast<ActiveDirectoryAccessRule>()
        .Where(rule => rule.IdentityReference == identity)
        .Where(rule => (rule.ActiveDirectoryRights & ActiveDirectoryRights.WriteProperty) == ActiveDirectoryRights.WriteProperty)
        .Count() > 0);

foreach (var item in itemsWithWriteAccess)
{
    Debug.Print(item.Name);
}

Answer 1

经过很长时间和Harvey的帮助|通过this question我终于找到了一个很好的工作解决方案。

正如 Harvey 已经解释的那样，要真正进一步了解您将在 entry.Properties["allowedAttributesEffective"].Value 中得到什么可能有点困难。但对于正常用途，您只需检查此字段是否为非空即可获得写入权限。

示例代码如下:

// (replace "part_of_group_name" with some partial group name existing in your AD)
var groupNameContains = "part_of_group_name";

var identity = WindowsIdentity.GetCurrent().User;
var allDomains = Forest.GetCurrentForest().Domains.Cast<Domain>();

var allSearcher = allDomains.Select(domain =>
{
    var searcher = new DirectorySearcher(new DirectoryEntry("LDAP://" + domain.Name));

    // Apply some filter to focus on only some specfic objects
    searcher.Filter = String.Format("(&(objectClass=group)(name=*{0}*))", groupNameContains);
    return searcher;
});

var directoryEntriesFound = allSearcher
    .SelectMany(searcher => searcher.FindAll()
        .Cast<SearchResult>()
        .Select(result => result.GetDirectoryEntry()));

var allowedTo = directoryEntriesFound.Select(entry =>
    {
        using (entry)
        {
            entry.RefreshCache(new string[] { "allowedAttributesEffective" });
            var rights = entry.Properties["allowedAttributesEffective"].Value == null ? "read only" : "write";
            return new { Name = entry.Name, AllowedTo = rights };
        }
    });

foreach (var item in allowedTo)
{
    var message = String.Format("Name = {0}, AllowedTo = {1}", item.Name, item.AllowedTo);
    Debug.Print(message);
}