Develop Reference

Get members of Active Directory Group and check if they are active or inactive

I'm trying to search for users in AD and display them in a list box only when they are inactive.
This is the code I have written
private void button1_Click(object sender, EventArgs e)
{
PrincipalContext insPrincipalContext = new PrincipalContext(ContextType.Domain, "DX", "DC=RX,DC=PX,DC=com");
ListUser(insPrincipalContext);
}
private void ListUser(PrincipalContext insPrincipalContext)
{
UserPrincipal insUserPrincipal = new UserPrincipal(insPrincipalContext);
insUserPrincipal.Name = "*";
SearchUsers(insUserPrincipal);
}
private void SearchUsers(UserPrincipal parUserPrincipal)
{
listBox1.Items.Clear();
PrincipalSearcher insPrincipalSearcher = new PrincipalSearcher();
insPrincipalSearcher.QueryFilter = parUserPrincipal;
PrincipalSearchResult<Principal> results = insPrincipalSearcher.FindAll();
foreach (Principal p in results)
{
UserPrincipal theUser = p as UserPrincipal;
if (theUser != null)
{
if (***theUser.IsAccountLockedOut()***)//**Is this same as Active or Inactive?**
{
listBox1.Items.Add(p);
}
else
{
}
}
}
}
So my question is whether (theUser.)IsAccountLockedUp is same as asking if the user is inactive?
I know one might suggest that this question is a copy of Get members of Active Directory Group and check if they are enabled or disabled but the problem here is I don't have test users to test on and I'm just starting with C#.
Thank You

IsAccountLockedOut corresponds to "Account is locked out" in the Active Directory account properties. This means that account was locked due to too many bad password attempts.
There is another setting in the properties "Account is disabled". This is often used by Administrators (of Identity Management Systems in large enterprise environments) to disable a account if the corresponding person left the company. So the account cannot be used anymore, but it is still there and works for SID lookup (will be displayed as name in groups or ACLs).
Ask yourself what your intention is. What do mean by "inactive" ?
You can probably use this as a starting point:
if (theUser != null)
{
if (theUser.IsAccountLockedOut())
{
// account locked out
}
// Enabled is nullable bool
if (!(theUser.Enabled == true))
{
// account disabled
}
if (theUser.LastLogon == null ||
theUser.LastLogon < DateTime.Now - TimeSpan.FromDays(150))
{
// never logged on or last logged on long time ago
// see below in the text for important notes !
}
}
Checking for LastLogon can be useful to find orphaned accounts. But be aware that a women may be in maternity leave :-)
Important
In Active Directory, there are two similar attributes:
LastLogon
LastLogonTimeStamp
See
http://blogs.technet.com/b/askds/archive/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works.aspx
for the difference. Short: only the LastLogonTimeStamp attribute is replicated between domain controllers and can be safely used for checking orphaned accounts. But even LastLogonTimeStamp is not really accurate, but is sufficient for detecting "old" / unused accounts.
I have not yet checked to which of them UserPrinciple.LastLogon corresponds. Be careful.
I am in the process of writing an own library for searching in the AD, which is based on the System.DirectoryServices classes. This has some benefits: better control and better performance. If it is ready, I will probably make it public.

Creating and updating appointments in Exchange

I'm trying to implement creating/updating appointments via C# code. I'm using dedicated exchange account and webdav to communicate. Updating appointment require saving this appointment to our tech-user mailbox.
Is there any other option to create and update appointments? Right now I'm struggling limits in quantity of calendar appointment on single mailbox.
I'm sure there should be other option but I can not see it.
Looking to see if anyone else has any suggestions or solutions to this issue.
Thanks

Creating an appointment...
//Give values to Subject,body,....
_service is the Exchange service object.
Appointment app = new Appointment(_service);
app.Subject = subject;
app.Body = body;
app.Start = startTime;
app.End = endTime;
app.Location = location;
DayOfTheWeek[] days = new DayOfTheWeek[] { DayOfTheWeek.Saturday };
app.Recurrence = new Recurrence.WeeklyPattern(app.Start.Date, 1, days);
app.Recurrence.StartDate = app.Start.Date;
app.Recurrence.NumberOfOccurrences = 3;
app.Save();
If you need further information please ask...

Permitted logon hours on group with Active Directory

I search for a long time how I can define permitted logon hours on group like it is possible to do with user from the account tab in Active Directory.
I already have a class in c# that can make queries to returns a list of all permitted hours of a user with the help 'logonhours' properties.
public byte[] GetLogonHours(string userName, string password, string path)
{
DirectoryEntry entry = this.GetUserAccount(userName, path);
return (byte[])entry.Properties["logonHours"].Value;
}
public DirectoryEntry GetUserAccount(string username, string path)
{
using (DirectoryEntry objRootEntry = new DirectoryEntry(path))
{
using (DirectorySearcher objAdSearcher = new DirectorySearcher(objRootEntry))
{
objAdSearcher.Filter = "(&(objectClass=user)(samAccountName=" + username + "))";
SearchResult objResult = objAdSearcher.FindOne();
if (objResult != null)
{
return objResult.GetDirectoryEntry();
}
}
}
return null;
}
I used this post to help me understanding how I can query the logon hours:
http://anlai.wordpress.com/2010/09/07/active-directory-permitted-logon-times-with-c-net-3-5-using-system-directoryservices-accountmanagement/
It is important to understand that I don't want a feature to know when the last time a user has been logged. What I have is a feature that prevent a user logging at some moments.
What I want is a feature that can apply logon hours for a group of users and I can query the Active Directory with c# to get these logon hours information.
Thank you very much.

In my understanding logon hours information is a user information. As discribed in HOW TO: Limit User Logon Time in a Domain in Windows Server 2003 pointed by #Knite you can change it :
User by user, whatever if you loop on a list of user
Applying a GPO to an organizationalUnit users belongs to
In your case you can loop for all the members of a group and change their logon hours.

According to http://support.microsoft.com/kb/816666 , you should generate the list of users in a group and write their logon hours to a CSV file.

Unable to see programmatically entered events in Google Calendar

I've written a entry form for our company employees to enter marketing courses into the DB and at the same time add them to a Google Calendar. The Calendar is accepting the events, but the coloration of the event is different from a "manually" entered event using Google's interface. This leads me to believe that there is some property I am not setting that is causing the events not to be show on the calendar once it is embedded in our other company web pages.
The code used to enter events:
// Create a CalenderService and authenticate
CalendarService myService = new CalendarService("exampleCo-exampleApp-1");
myService.setUserCredentials("xxx#gmail.com", "xxxxxx");
CalendarQuery query = new CalendarQuery();
query.Uri = new Uri("https://www.google.com/calendar/feeds/default/owncalendars/full");
CalendarFeed resultFeed = (CalendarFeed)myService.Query(query);
Uri postUri = new Uri("https://www.google.com/calendar/feeds/default/owncalendars/full");
foreach (CalendarEntry centry in resultFeed.Entries)
{
litErrorMsg.Text += centry.Title.Text + "<br />";
if (centry.Title.Text == "fmicoursecalendar#gmail.com")
{
postUri = new Uri("https://www.google.com/calendar/feeds/" +
centry.SelfUri.ToString().Substring(centry.SelfUri.
ToString().LastIndexOf("/") + 1) + "/private/full");
break;
}
}
Google.GData.Calendar.EventEntry entry = new Google.GData.Calendar.EventEntry();
// Set the title and content of the entry.
entry.Title.Text = eventName;
entry.Content.Content = eventName;
//entry.QuickAdd = true;
entry.EventVisibility = new Google.GData.Calendar.EventEntry.Visibility("event.public");
When eventTime = new When(Convert.ToDateTime(startDate), Convert.ToDateTime(endDate));
entry.Times.Add(eventTime);
GDataGAuthRequestFactory requestFactory = (GDataGAuthRequestFactory)myService.RequestFactory;
requestFactory.CreateRequest(GDataRequestType.Insert, postUri);
// Send the request and receive the response:
AtomEntry insertedEntry = myService.Insert(postUri, entry);
And this is the resulting calendar:
The "test event jasdf event" is the manually entered event, and the two events: "Test event 234" are the programmatically entered events. In any case, once I embed the calendar, the only event showing up is the "test event jasdf".
I tried to manually set the event to PUBLIC but that didn't seem to help.
Anyone faced this issue before or had success with google calendar? If so, I'd like to see what you might have used to successfully create events and publish them.
Thanks!

Tom -
Have you figured this issue out yet? I'm thinking that you might be adding events to the wrong calendar... this would explain both of your problems:
The events are colored differently because you're viewing multiple calendars simultaneously, and Google Calendar uses different colors for each calendar.
Once you embed the single calendar that you think contains the events, you're only seeing the events that are actually on that specific calendar... hence, none of the events which were incorrectly placed.
The key here would be to check exactly which calendars you're viewing in the Google Calendar interface, and then look to see where the programmatically inserted events are ending up.

Facebook / Offline Permission - Trying to perform an action on a set of offline users

We're building an app which in part of its functionality tries to capture the number of likes associated to a particular video owned by a user.
Users of the app are asked for extended off-line access and we capture the key for each user:
The format is like this: 2.hg2QQuYeftuHx1R84J1oGg__.XXXX.1272394800-nnnnnn
Each user has their offline / infinite key stored in a table in a DB. The object_id which we're interested in is also stored in the DB.
At a later stage (offline) we try to run a batch job which reads the number of likes for each user's video. (See attached code)
For some reason however, after the first iteration of the loop - which yields the likes correctly, we get a failure with the oh so familiar message:
"Session key is invalid or no longer valid"
Any insight would be most appreciated.
Thanks,
B
List<DVideo> videoList = db.SelectVideos();
foreach (DVideo video in videoList)
{
long userId = 0;
ConnectSession fbSession = new ConnectSession(APPLICATION_KEY, SECRET_KEY);
//session key is attached to the video object for now.
fbSession.SessionKey = video.UserSessionKey;
fbSession.SessionExpires = false;
string fbuid =video.FBUID;
long.TryParse(fbuid, out userId);
if (userId > 0)
{
fbSession.UserId = userId;
fbSession.Login();
Api fbApi = new Facebook.Rest.Api(fbSession);
string xmlQueryResult = fbApi.Fql.Query("SELECT user_id FROM like WHERE object_id = " + video.FBVID);
XmlDocument xmlDoc = new XmlDocument();
xmlDoc.Load(new StringReader(xmlQueryResult));
int likesCount = xmlDoc.GetElementsByTagName("user_id").Count;
//Write entry in VideoWallLikes
if (likesCount > 0)
{
db.CountWallLikes(video.ID, likesCount);
}
fbSession.Logout();
}
fbSession = null;
}

You said you have asked user for extended offline access, but by looking at your access token, it is not long-lived. your token is 2.hg2QQuYeftuHx1R84J1oGg__.XXXX.1272394800-nnnnnn, within it, the "1272394800" is expiration epoch time.