Error creating user with more than 20 characters in sAMAccountName using .NET.

Question

I am trying to programmatically create a new Active Directory user that sets the sAMAccountName attribute with a value greater than 20 characters.

When I call DirectoryEntry.CommitChanges (), I get an error:

00000523: SysErr: DSID-031A0FB6, issue 22 (invalid argument), data 0

If I try to create a new user, sAMAccountName is less than 20 characters, everything will work.

Before anyone says that the sAMAccountName name limit is 20 characters, I want to point out that if I try to create the same user with sAMAccountName more than 20 characters using the Windows Active Directory Users and Computers tool, everything will work, I I see a new record in AD using the LDP tool, and the record has the name sAMAccountName with more than 20 characters.

Why can't I create a user using .NET?

The following is the code I'm using:

Using objDirEnt As DirectoryEntry = New DirectoryEntry("LDAP://my.domain.com/cn=Users,dc=my,dc=domain,dc=com", "username", "Password", AuthenticationTypes.Secure Or AuthenticationTypes.Sealing) Using usuario As DirectoryEntry = objDirEnt.Children.Add("CN=aaaaaa bbbbbbbbbb ccccccccc (aaaaaa.bbbbbb.ccccccccc)", "user") usuario.Properties("sAMAccountName").Value = "aaaaaa.bbbbbb.ccccccccc" usuario.Properties("userAccountControl").Value = AdsUserFlags.PasswordNotRequired usuario.Properties("name").Value = "aaaaaa bbbbbbbbbb ccccccccc" usuario.Properties("givenName").Value = "aaaaaa" usuario.Properties("sn").Value = "bbbbbbbbbb ccccccccc" usuario.CommitChanges() End Using End Using 

Answer 1

the default limit for this field is less than 20 characters in accordance with this article: http://msdn.microsoft.com/en-us/library/ms679635.aspx I have not tried to create a user with 20chars sAMAccountName, but maybe this is possible using the Novell LDAP library. I had to use it because we also needed to support other LDAP services. http://www.novell.com/coolsolutions/feature/11204.html

I also found these posts: https://serverfault.com/questions/344815/how-to-add-a-user-in-active-directory-with-name-longer-than-20-characters

Answer 2

As @stylefish explains, according to the Microsoft documentation , this is a function. You can probably put there, in some way, more than 20 characters, but I'm sure that the first 20 characters should be uniq into the forest.

If you want to use more characters to login, you must use userPrincipalName (in the form of login @ Dns-Domain). In W2K3, the length of this attribute is limited to 1023 characters. You can calculate the MD5 digest to calculate the corresponding samAccountName.