真实用户和系统用户帐户之间的区别答案

【问题标题】：Difference between real user and system user accounts真实用户和系统用户帐户之间的区别
【发布时间】：2011-10-10 10:11:05
【问题描述】：

当我获得机器或 Active Directory 域的 UserPrincipal/DirectoryEntry 记录时，有没有办法区分系统帐户和真实用户？

例如，jsmith 是真实用户，而 ASPNET 或 IUSR_machine 不是。但是依靠硬编码的已知名称似乎并不是过滤掉系统用户的最佳方法，因为还可以有其他帐户。有没有更好的办法？

例如，可能有“可以交互登录”标志，或者通过检查是否设置了密码等方式进行检测。

【问题讨论】：

标签： active-directory directoryservices user-accounts

【解决方案1】：

就所有意图和目的而言，您列出的示例帐户在功能上与您为指定人员创建的用户帐户相同。

【讨论】：

【解决方案2】：

试试 Win32 LookupAccountName 和 LookupAccountSid 方法。函数返回时，最后一个参数（称为accountType）填写账户类型。

 [SecurityPermission(SecurityAction.Demand, UnmanagedCode = true)]
 [ReliabilityContract(Consistency.WillNotCorruptState, Cer.MayFail)]
 [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
 [return: MarshalAs(UnmanagedType.Bool)]
 public static extern bool LookupAccountSid(
        [In] string systemName,
        [In, MarshalAs(UnmanagedType.LPArray)] byte[] sid,
        [Out] StringBuilder name,
        [In, Out] ref uint nameLength,
        [Out] StringBuilder referencedDomainName,
        [In, Out] ref uint referencedDomainNameLength,
        [Out] out AccountType accountType);

 [SecurityPermission(SecurityAction.Demand, UnmanagedCode = true)]
 [ReliabilityContract(Consistency.WillNotCorruptState, Cer.MayFail)]
 [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
 [return: MarshalAs(UnmanagedType.Bool)]
 public static extern bool LookupAccountName(
        [In] string systemName,
        [In] string accountName,
        [Out, MarshalAs(UnmanagedType.LPArray)] byte[] sid,
        [In, Out] ref uint sidSize,
        [Out] StringBuilder referencedDomainName,
        [In, Out] ref uint referencedDomainNameLength,
        [Out] out AccountType accountType);


/// <summary>
/// Defines the various account types of a Windows accunt
/// </summary>
public enum AccountType
{
    /// <summary>
    /// No account type
    /// </summary>
    None = 0,
    /// <summary>
    /// The account is a user
    /// </summary>
    User,
    /// <summary>
    /// The account is a security group
    /// </summary>
    Group,
    /// <summary>
    /// The account defines a domain
    /// </summary>
    Domain,
    /// <summary>
    /// The account is an alias
    /// </summary>
    Alias,
    /// <summary>
    /// The account is a well-known group, such as BUILTIN\Administrators
    /// </summary>
    WellknownGroup,
    /// <summary>
    /// The account was deleted
    /// </summary>
    DeletedAccount,
    /// <summary>
    /// The account is invalid
    /// </summary>
    Invalid,
    /// <summary>
    /// The type of the account is unknown
    /// </summary>
    Unknown,
    /// <summary>
    /// The account is a computer account
    /// </summary>
    Computer,
    Label
}

【讨论】：

真实用户和系统用户返回的 AccountType 会不会相同 - 即两者都返回 AccountType.User？
它将为内置管理员组返回类似“别名”的内容。但我猜你对 ASPNET 用户或 IUSR_machine 的看法是正确的......交互式登录权限可能是一个线索......

【解决方案3】：

尝试使用"samaccountname" property 删除不属于用户或组的帐户。

【讨论】：