Search code examples
windowsadsi

seeking example using ADSI API to programmatically create a Windows Group

Seeking example using ADSI API to programmatically create a Windows Group. AD is Windows Active Directory http://en.wikipedia.org/wiki/Active_Directory

'SI' maybe Service Interface?

Anyway, this area is just not well documented. . . I have seen some PowerShell scripts . . . but really do not want to have to ensure PowerShell is installed etc. A simple program that runs and makes sure MY_XYZ_GROUP is added to the Window's set of Groups.....

Should be easy.... Appears not so easy.

Solution

  • ADSI = Active Directory Service Interfaces - it's an API to talk to Active Directory to create users, groups, computer accounts in Active Directory - the network based LDAP directory for Microsoft networks.

    So do you need to create local users on a local machine/server, or do you need to create groups in your Active Directory??

    If you're programming in .NET 3.5 and up, you should check out the System.DirectoryServices.AccountManagement (S.DS.AM) namespace. Read all about it here:

    Basically, you can define a domain context and easily find users and/or groups in AD:

    // set up domain context
PrincipalContext ctx = new PrincipalContext(ContextType.Domain);

// find a user
UserPrincipal user = UserPrincipal.FindByIdentity(ctx, "SomeUserName");

if(user != null)
{
   // do something here....     
}

// create a group 
GroupPrincipal group = new GroupPrincipal(ctx, "Group01");
// set other properties on the group here.....
group.Save();

    The new S.DS.AM makes it really easy to play around with users and groups in AD!

    Update: unforutnately, the new S.DS.AM doesn't work with local groups :-( it's only intended for Active Directory use.

    If you need to create a local Windows group, you need to use the older DirectoryEntry approach - something like:

    // bind to your machine's WinNT:// provider
DirectoryEntry computer = new DirectoryEntry("WinNT://YourMachineNameHere");

// create a new local group on your computer
DirectoryEntry newGroup = computer.Children.Add("NewGroupName", "Group");

// save that group to the local machine
newGroup.CommitChanges();

// refresh the property cache so you can set properties like "Description" or others
newGroup.RefreshCache();
newGroup.Properties["description"].Value = "Description for your group....";
newGroup.CommitChanges();

    Richard Mueller has a great list of Excel sheets showing all the various properties available, both on the LDAP-based Active Directory objects, as well as the very limited WinNT properties.