Active Directory: The Principal Class - S.DS.AM vs

问题:

I am working on an access audit report for Active Directory. I am extracting data via a C# script component in SSIS, using LDAP, into a SQL Server database. This is my first major foray into AD, so I freely admit a lack of intimate knowledge. I am trying to remove the blinders by asking those with experience on the topic. Pardon me in advance if I have mixed any of my metaphors.

With respect to retrieving data for all users, is it best just to stick with the Principal Class, and access GroupPrincipal, UserPrincipal, and ComputerPrincipal (i.e. concrete classes) via S.DS.AM, or is it better to get everything from S.DS.AD (see reference below)? I understand that both are subclassed off S.DS, so it is possible to miss objects not contained in the from S.DS.AD when using S.DS.AM. Is there any pertinent data or objects that is contained in S.DS.AD, but not in S.DS.AM, that would be helpful for an access control audit? Also, I understand that if PageSize=1000 then I may need to go with S.DS.AD and then loop through S.DS.AM.

If it is best to use S.DS.AM, is there a way to capture any abstract or auxillary classes that have been created and are sub-classed off of the concrete classes? Would I just use StructuralObjectClass property value?

S.DS.AD: https://msdn.microsoft.com/en-us/library/system.directoryservices.activedirectory(v=vs.110).aspx

S.DS.AM: https://msdn.microsoft.com/en-us/library/system.directoryservices.accountmanagement(v=vs.110).aspx

回答1:

System.DirectoryServices.AccountManagement namespace is a wrapper over System.DirectoryServices. The namespace contains classes covering the most common cases which programmers face, while working with AD. These classes are designed to perform a limited set of tasks in small to medium environments and have performance issues.

For example GroupPrincipal.Members will load the entire group membership on first call, which may not be the desired behavior in enterprise environments where groups may contain 10-100k principals and range retrieval is the best option.

Using System.DirectoryServices or System.DirectoryServices.Protocols allows you to manage resources (RAM, network traffic) that your process uses while communicating with AD.

System.DirectoryServices.ActiveDirectory may be used in every environment, as the amount of data these classes return is quite small (e.g. Active Directory schema, sites, domain controllers)