如何查询Active Directory中包含已删除对象的更改？

我使用下面的代码来查询AD中用户/ OU的更改。 但它不会检索任何已删除的对象，不知道如何在此包含已删除的对象？

static void Main(string[] args) { BinaryFormatter bFormat = new BinaryFormatter(); byte[] cookie = null; string strFileName = "cookie.bin"; if (File.Exists(strFileName)) { using (FileStream fsStream = new FileStream(strFileName, FileMode.OpenOrCreate)) { cookie = (byte[])bFormat.Deserialize(fsStream); } } string str_dcName = "xxxxx"; System.DirectoryServices.DirectoryEntry rootDSE = new System.DirectoryServices.DirectoryEntry("LDAP://rootDSE"); System.Net.NetworkCredential cr = new System.Net.NetworkCredential(@"xxx", "xxx", "xxx"); LdapConnection connection = new LdapConnection(str_dcName); connection.Credential = cr; connection.Bind(); string[] attribs = new string[3]; attribs[0] = "name"; attribs[1] = "description"; attribs[2] = "objectGUID"; SearchRequest request = new SearchRequest("DC=xxx,DC=xxx,DC=com", "(objectClass=*)", SearchScope.Subtree, attribs); DirSyncRequestControl dirSyncRC = new DirSyncRequestControl(cookie, DirectorySynchronizationOptions.IncrementalValues, Int32.MaxValue); request.Controls.Add(dirSyncRC); bool bMoreData = true; SearchResponse searchResponse = (SearchResponse)connection.SendRequest(request); while (bMoreData) //Initial Search handler - since we're unable to combine with paged search { foreach (SearchResultEntry entry in searchResponse.Entries) { System.Collections.IDictionaryEnumerator attribEnum = entry.Attributes.GetEnumerator(); while (attribEnum.MoveNext())//Iterate through the result attributes { //Attributes have one or more values so we iterate through all the values //for each attribute DirectoryAttribute subAttrib = (DirectoryAttribute)attribEnum.Value; for (int ic = 0; ic < subAttrib.Count; ic++) { //Attribute Name below Console.WriteLine(attribEnum.Key.ToString()); //Attribute Sub Value below Console.WriteLine(subAttrib[ic].ToString()); } } } //Get the cookie from the response to use it in next searches foreach (DirectoryControl control in searchResponse.Controls) { if (control is DirSyncResponseControl) { DirSyncResponseControl dsrc = control as DirSyncResponseControl; cookie = dsrc.Cookie; bMoreData = dsrc.MoreData; break; } } dirSyncRC.Cookie = cookie; searchResponse = (SearchResponse)connection.SendRequest(request); } //Serialize the cookie into a file to use in next searches using (FileStream fsStream = new FileStream(strFileName, FileMode.Create)) { //Serialize the data to the steam. To get the data for //the cookie, call the GetDirectorySynchronizationCookie method. bFormat.Serialize(fsStream, cookie); } Console.WriteLine("Finished search..."); Console.ReadKey(); } 

Answer 1

解决方案是需要将isDeleted=TRUE添加到请求对象

 SearchRequest request = new SearchRequest("DC=xx,DC=xxx,DC=com", "(|(objectClass=organizationalUnit)(isDeleted=TRUE)(objectCategory=Person))", SearchScope.Subtree, attribs); 

Answer 2

至于我使用SearchRequest的经验，filter不会不惜任何代价运行，它有自己的问题..对于你的情况来获取删除对象的更改你应该使用Domain Admin特权帐户或类似的东西..

在这里，您需要授予对“已删除对象”容器具有完全权限的特权帐户。

 System.Net.NetworkCredential cr = new System.Net.NetworkCredential(@"administrator", "xxx", "xxx"); LdapConnection connection = new LdapConnection(str_dcName);