List AD User Accounts Excluding Service Accounts

[suityou01]

I need to get a list of user accounts from Active Directory using C#. This should exclude "Service Accounts". I note from Windows2008R2 + there are now "Managed Service Accounts" which are quasi user accounts masquerading as machines which means they are service level accounts that can be managed at a domain level. Got it? Well I don't want them either. Just flesh and blood users.

So here's me code

using (DirectorySearcher ds = new DirectorySearcher(_directoryEntry, "(&(objectClass=user)(objectCategory=person))"))
            {

                try
                {
                    ds.PageSize = 1000;

                    /*core data*/
                    ds.PropertiesToLoad.Add("sAMAccountName");
                    ds.PropertiesToLoad.Add("mail");
                    ds.PropertiesToLoad.Add("objectSid");
                    ds.PropertiesToLoad.Add("servicePrincipalName");

I thought I'd cracked it when I found a property called servicePrincipalName - described in the MSDN as

Service principal names are associated with the security principal (user or groups) in whose security context the service executes. SPNs are used to support mutual authentication between a client application and a service

Except that this multivalue propery is emtpy for IUSR and IWAM accounts etc.

Any takers?

I will take a powershell example.

TIA

Humbly

The slightly less awesome

Suity

[northernladuk]

Do you have a project code I can book my time to please.

[suityou01]

Do you have a project code I can book my time to please.

Yes, it's.

YACCOTBAC

HTH

[eek]

Do you have a project code I can book my time to please.

Surely its can you send me your purchase order, I can start work once its received...

[suityou01]

Quite.

I did this

(&(objectClass=user)(objectCategory=person)(mail=*))

in my LDAP filter.

Since service accounts shouldn't have email addresses I'm hoping I can enforce this as a rule.

Flame away.

[eek]

Quite.

I did this

(&(objectClass=user)(objectCategory=person)(mail=*))

in my LDAP filter.

Since service accounts shouldn't have email addresses I'm hoping I can enforce this as a rule.

Flame away.

You are making the assumption a user has an email address. That is a brave decision....

[suityou01]

You are making the assumption a user has an email address. That is a brave decision....

You are not providing an alternative. That's an easy thing to do when criticising.

[eek]

You are not providing an alternative. That's an easy thing to do when criticising.

I'm still waiting for the purchase order. I will however happily highlight problems within your current approach to emphasis why you need me....

[doodab]

You are not providing an alternative. That's an easy thing to do when criticising.

What about services which send email?

Why not use multiple tests on say address, phone number etc.

[stek]

dir \Users\*