如何以编程方式访问Active Directory中的Maximum Password Age属性？

We're trying to implement a Password Expiration handling mechanism in a ASP.NET MVC app using Active Directory for authorization, and we need access to Maximum Password Age value to provide a correct expiration period. However, we've not been able to access the value/property via these instructions (or similar approaches), using the DirectoryEntry API:

我们正在尝试使用Active Directory在ASP.NET MVC应用程序中实现密码到期处理机制以进行授权，我们需要访问Maximum Password Age值以提供正确的有效期。但是，我们无法使用DirectoryEntry API通过这些说明（或类似方法）访问值/属性：

How can I get 'minimum password age' of user in active directory using asp.net?

如何使用asp.net获取活动目录中用户的“最小密码使用期限”？

Determine the maximum password age in Active Directory

确定Active Directory中的最长密码期限

In each case we simply get a NULL value for property maxPwdAge. We also query for MaxPwdAge, MaxPasswordAge, and MaximumPasswordAge (some sources suggested different property names). We also searched against different domain objects, namely the root container and the Users container to no avail.

在每种情况下，我们只需获取属性maxPwdAge的NULL值。我们还查询MaxPwdAge，MaxPasswordAge和MaximumPasswordAge（一些来源建议使用不同的属性名称）。我们还搜索了不同的域对象，即根容器和Users容器无济于事。

Is there any way to find the Maximum Password Age programmatically using the DirectoryEntry API. Or alternatively, the PrincipalContext API?

有没有办法使用DirectoryEntry API以编程方式查找最大密码年龄。或者，PrincipalContext API？

1 个解决方案

#1

So, AD allows fine grained password policies. This means that max age can vary by user depending upon the configuration of the directory. Further, there are a couple of ways to configure this (using the newer FGPP mechanism or the older per-domain policy mechanism).

因此，AD允许细粒度的密码策略。这意味着最大年龄可能因用户而异，具体取决于目录的配置。此外，有几种方法可以配置它（使用较新的FGPP机制或较旧的每域策略机制）。

Brian's advice from this post should get you going.

布莱恩对这篇文章的建议可以帮助你。