安全 ID 结构无效，为 AD 用户属性设置新的 SecurityDescriptor 时出现此错误

问题描述

我试图在 AD 帐户中设置用户选项，在创建帐户时我试图设置选项用户无法更改密码".

I am trying to set a user option in an AD Account, while creating the account i am trying to set the option "User Cannot Change Password".

但我在尝试设置新安全描述符的值时收到错误安全 ID 结构无效"错误.

But I am getting the error "Security ID Structure invalid" error, when trying to set the value of new security descriptor.

这是示例代码，

            string[] trustees = new string[] { @"NT AUTHORITYSELF", "EVERYONE" };

            IADsSecurityDescriptor sd = (IADsSecurityDescriptor)usr.Properties["ntSecurityDescriptor"].Value;
            IADsAccessControlList acl = (IADsAccessControlList)sd.DiscretionaryAcl;
            IADsAccessControlEntry ace = new AccessControlEntry();
            foreach (string trustee in trustees)    
            {
                ace.Trustee = trustee;
                ace.AceFlags = 0;
                //For remove 'User cannot change password' selection
                //ace.AceType = (int) ADS_ACETYPE_ENUM.ADS_ACETYPE_ACCESS_ALLOWED_OBJECT;
                ace.AceType = (int)ADS_ACETYPE_ENUM.ADS_ACETYPE_ACCESS_DENIED_OBJECT;
                ace.Flags = (int)ADS_FLAGTYPE_ENUM.ADS_FLAG_OBJECT_TYPE_PRESENT;
                ace.ObjectType = PASSWORD_GUID;
                ace.AccessMask = (int)ADS_RIGHTS_ENUM.ADS_RIGHT_DS_CONTROL_ACCESS;
                acl.AddAce(ace);

                ace.Trustee = trustee;
                ace.AceFlags = 0;
                ace.AceType = (int)ActiveDs.ADS_ACETYPE_ENUM.ADS_ACETYPE_ACCESS_DENIED_OBJECT;
                ace.Flags =  (int)ActiveDs.ADS_FLAGTYPE_ENUM.ADS_FLAG_OBJECT_TYPE_PRESENT;
                ace.ObjectType = PASSWORD_GUID;
                ace.AccessMask = (int)ActiveDs.ADS_RIGHTS_ENUM.ADS_RIGHT_DS_CONTROL_ACCESS;
                acl.AddAce(ace);
            }
            sd.DiscretionaryAcl = acl;                
            usr.Properties["ntSecurityDescriptor"].Value = (ActiveDs.IADsSecurityDescriptor)sd;
            usr.CommitChanges();

知道为什么我会收到此安全 ID 结构无效"错误.

Any Idea why i am getting this "Security ID structure is invalid" error.

推荐答案

我用谷歌搜索并在网上找到了类似的代码.我相信上面的代码应该可以工作.我确实看到有人有类似的抱怨.它似乎与您使用的帐户有关.您使用什么帐户来运行上述代码?

I googled and found similar codes on the web. I believe the above code should work. I did see somebody have similar complaints. It seems to be related to the account that you are using. What account are you using to run the above code?

另外，如果您可以使用 .NET 3.5 或更高版本，请尝试使用以下代码.

Also, if you can use .NET 3.5 or above, try using the following code.

using (PrincipalContext context = new PrincipalContext(ContextType.Domain, "YourDomain"))
{
    UserPrincipal up = UserPrincipal.FindByIdentity(context, "Domain\YourUser");
    up.UserCannotChangePassword = false;
    up.Save();
}