Programming for Active Directory: Creating User Accounts with Security Setup and Manager Assignment in C#

In this article, we will focus on the comprehensive creation of user accounts in Active Directory using C#. This includes ensuring proper security configurations, forcing users to change their passwords upon first login, setting account expiration, and assigning managers to the newly created user accounts.

By automating these tasks in C#, you not only ensure consistency but also improve administrative efficiency and reduce human error. We’ll walk through the entire process step by step, explaining each part of the code along the way.

Why Automate User Account Creation in Active Directory?

Managing users in Active Directory through manual intervention is time-consuming and error-prone, especially when dealing with large organizations. Automating the creation process with C# allows you to:

• Enforce Security Standards: Automatically configure secure defaults such as requiring a password change on first login.
• Streamline Organizational Structure: Programmatically assign managers to users.
• Improve Consistency: Ensure that all user accounts adhere to predefined policies and standards.

Setting Up a User Account with Security and Manager Assignment

The following steps explain how to create a new user account, enforce security settings like password changes, set an account expiration date, and assign a manager from Active Directory.

Code Walkthrough: Creating a User with Security and Manager Setup

using System;
using System.DirectoryServices.AccountManagement;
using System.DirectoryServices;

class Program
{
    static void Main(string[] args)
    {
        // Directory context for the domain controller
        string domainPath = "LDAP://YourDomainController";
        string username = "secureuser"; // New user's username
        string managerSamAccountName = "manageruser"; // Manager's SamAccountName
        string password = "ComplexP@ss123"; // Password for the new user
        string displayName = "Secure User"; // Display name for the user
        DateTime accountExpirationDate = new DateTime(2025, 12, 31); // Expiration date of the account

        // Create a variable for UserPrincipalName and EmailAddress
        string upnAndEmail = $"{username}@yourdomain.com"; // User Principal Name and Email Address

        using (var context = new PrincipalContext(ContextType.Domain, domainPath))
        {
            // Step 1: Find the manager by SamAccountName
            UserPrincipal manager = UserPrincipal.FindByIdentity(context, IdentityType.SamAccountName, managerSamAccountName);
            if (manager == null)
            {
                Console.WriteLine($"Manager with SamAccountName '{managerSamAccountName}' not found.");
                return;
            }

            // Step 2: Create the user with security settings and manager assignment
            UserPrincipal user = new UserPrincipal(context)
            {
                SamAccountName = username,
                Name = displayName,
                UserPrincipalName = upnAndEmail,  // Set UPN from variable
                EmailAddress = upnAndEmail,       // Set email from variable
                DisplayName = displayName,
                Enabled = true // Enable the account immediately
            };

            // Step 3: Set password and security settings
            user.SetPassword(password); // Set the user's password
            user.PasswordNeverExpires = false; // Password will expire
            user.UserCannotChangePassword = false; // Allow the user to change their password

            // Force the user to change their password at next login
            user.ExpirePasswordNow();

            // Step 4: Set account expiration date
            user.AccountExpirationDate = accountExpirationDate;

            // Step 5: Assign the manager to the user
            user.Manager = manager.DistinguishedName;

            // Save the user to Active Directory
            user.Save();
            Console.WriteLine("Secure user account created with manager assigned.");

            // Step 6: Print user details for validation
            PrintUserDetails(user);
        }
    }

    // Function to validate and print user information
    static void PrintUserDetails(UserPrincipal user)
    {
        DirectoryEntry de = (DirectoryEntry)user.GetUnderlyingObject();

        // Retrieving user details
        string displayName = user.DisplayName;
        string userPrincipalName = user.UserPrincipalName;
        string email = user.EmailAddress;
        string description = de.Properties["description"].Value != null ? de.Properties["description"].Value.ToString() : "No description";
        string samAccountName = user.SamAccountName;
        DateTime? passwordLastSet = user.LastPasswordSet;
        DateTime? passwordExpiration = user.AccountExpirationDate;
        bool passwordCannotBeChanged = user.UserCannotChangePassword;

        // Printing out the user information
        Console.WriteLine($"User Principal Name: {userPrincipalName}");
        Console.WriteLine($"Email: {email}");
        Console.WriteLine($"Display Name: {displayName}");
        Console.WriteLine($"Description: {description}");
        Console.WriteLine($"SAM Account Name: {samAccountName}");
        Console.WriteLine($"Password Last Changed: {passwordLastSet}");
        Console.WriteLine($"Password Expiration Date: {passwordExpiration ?? DateTime.MaxValue}");
        Console.WriteLine($"Password Cannot Be Changed by User: {passwordCannotBeChanged}");
        Console.WriteLine($"Manager: {user.Manager}");
    }
}

Breaking Down the Code

Let’s go over each important part of the code to explain what is happening and why.

Step 1: Finding the Manager by SamAccountName

We use UserPrincipal.FindByIdentity() to search for the manager’s account using their SamAccountName. This method returns a UserPrincipal object representing the manager in Active Directory.

UserPrincipal manager = UserPrincipal.FindByIdentity(context, IdentityType.SamAccountName, managerSamAccountName);
if (manager == null)
{
    Console.WriteLine($"Manager with SamAccountName '{managerSamAccountName}' not found.");
    return;
}

This step ensures that we retrieve the correct manager from Active Directory. If the manager cannot be found, the process stops with a message.

Step 2: Creating the User Account

We then create a new user in Active Directory by instantiating the UserPrincipal class and setting various properties:

• SamAccountName: The account name.
• UserPrincipalName: A unique identifier for the user in Active Directory.
• EmailAddress: Set to the same value as UserPrincipalName for consistency.
• DisplayName: The user's full display name, typically shown in address books and other organizational systems.

UserPrincipal user = new UserPrincipal(context)
{
    SamAccountName = username,
    Name = displayName,
    UserPrincipalName = upnAndEmail,  // Set UPN from variable
    EmailAddress = upnAndEmail,       // Set email from variable
    DisplayName = displayName,
    Enabled = true // Enable the account immediately
};

Step 3: Setting Security Attributes

We enforce several security-related properties when creating the account:

• SetPassword(): Defines the user’s initial password.
• PasswordNeverExpires: Set to false to ensure that the user’s password will eventually expire.
• UserCannotChangePassword: Set to false to allow the user to change their password after logging in.
• ExpirePasswordNow(): Forces the user to change their password upon first login.

user.SetPassword(password); // Set the user's password
user.PasswordNeverExpires = false; // Password will expire
user.UserCannotChangePassword = false; // Allow the user to change their password
user.ExpirePasswordNow(); // Force password change at next login

Step 4: Setting Account Expiration

We can also set an expiration date for the user account. If the date is reached, the account will be automatically disabled.

user.AccountExpirationDate = accountExpirationDate;

Step 5: Assigning the Manager

Using the manager’s DistinguishedName (retrieved earlier), we assign the manager to the new user by setting the Manager property.

user.Manager = manager.DistinguishedName;

Step 6: Saving the User and Validating

After configuring the user account, we save it to Active Directory using the user.Save() method. Then, we call the PrintUserDetails() function to validate that all user properties have been set correctly.

user.Save();
Console.WriteLine("Secure user account created with manager assigned.");
PrintUserDetails(user);

Conclusion

This article has walked through the process of creating a secure user account in Active Directory, including setting security properties and assigning a manager. By automating these tasks with C#, you ensure consistency across your organization and save valuable administrative time.

Interacting with Active Directory Using C#

Introduction to Active Directory

Active Directory (AD) is a directory service developed by Microsoft that serves as a central repository for network resources. It provides a way to manage user accounts, computers, and other resources within a network environment. AD plays a crucial role in authentication, authorization, and management of identity in Windows environments.

Managing Active Directory through C# offers several advantages, including:

1. Automation: Streamline repetitive tasks, such as user creation and group management.
2. Consistency: Ensure uniformity in object creation, minimizing human error.
3. Integration: Easily integrate with other applications and systems.

Why Use C# for Active Directory Management?

C# is a powerful and versatile language that provides robust features for interacting with AD, such as:

• Strongly typed objects for representing directory entries.
• Libraries that facilitate connection and operations on AD.
• Support for asynchronous programming, making operations more efficient.

Required Libraries

To work with Active Directory in C#, you will need the following NuGet packages:

• System.DirectoryServices: This library provides classes for working with Active Directory Domain Services.
• System.DirectoryServices.AccountManagement: This library simplifies the management of AD accounts.

To install these packages, use the following commands in your terminal or Package Manager Console:

dotnet add package System.DirectoryServices
dotnet add package System.DirectoryServices.AccountManagement

Creating New User Objects

When creating a new user in Active Directory, it's important to maintain consistency in the properties you set. Below is an example of how to create a new user object in AD using C#.

Code Example: Creating a User

using System;
using System.DirectoryServices;
using System.DirectoryServices.AccountManagement;

class Program
{
    static void Main(string[] args)
    {
        string domainPath = "LDAP://YourDomainController"; // Example: LDAP://DC=yourdomain,DC=com
        string username = "newuser";
        string password = "P@ssw0rd";

        using (var context = new PrincipalContext(ContextType.Domain, domainPath))
        {
            UserPrincipal user = new UserPrincipal(context)
            {
                SamAccountName = username,
                SetPassword(password),
                Name = "New User",
                UserPrincipalName = $"{username}@yourdomain.com",
                EmailAddress = "newuser@yourdomain.com",
                Enabled = true
            };

            user.Save();
            Console.WriteLine("User created successfully.");
        }
    }
}

Explanation:

• PrincipalContext: Represents the domain context in which you will create the user.
• UserPrincipal: Represents a user object in AD, allowing you to set various properties.
• SetPassword: Method to set the user's password. Ensure the password meets the domain's complexity requirements.

Creating New Group Objects

Similarly, creating a group in AD allows for better management of user permissions. Below is an example code snippet for creating a new group.

Code Example: Creating a Group

using System;
using System.DirectoryServices;
using System.DirectoryServices.AccountManagement;

class Program
{
    static void Main(string[] args)
    {
        string domainPath = "LDAP://YourDomainController"; // Example: LDAP://DC=yourdomain,DC=com
        string groupName = "NewGroup";

        using (var context = new PrincipalContext(ContextType.Domain, domainPath))
        {
            GroupPrincipal group = new GroupPrincipal(context)
            {
                Name = groupName,
                Description = "This is a new group."
            };

            group.Save();
            Console.WriteLine("Group created successfully.");
        }
    }
}

Explanation:

• GroupPrincipal: Represents a group object in AD, allowing you to set properties like Name and Description.
• Save: Persist the new group object to Active Directory.

Conclusion

Interacting with Active Directory using C# provides a powerful way to manage users and groups effectively. By leveraging the consistency offered through structured coding practices, developers can minimize errors and streamline the management process. Whether creating user accounts or group objects, C# provides the necessary tools and libraries to ensure successful integration with Active Directory.

Additional Considerations

When developing applications that interact with Active Directory, consider the following:

• Error Handling: Implement robust error handling to manage exceptions that may arise during AD operations.
• Security: Ensure sensitive information, like passwords, is handled securely and follow best practices for security.
• Testing: Thoroughly test your application in a safe environment before deploying it in a production setting.

With .NET 8 and the right libraries, managing Active Directory becomes not only feasible but also efficient and consistent, making it a valuable skill for IT professionals.