Directory Programming .NET

I don't know the optimum answer on this one, but I would go with a subtree search before using referral chasing.  Given that you can index your filter a bit more (use objectCategory in there), I don't think you are going to pay an enormous price for the larger scope, but I would have to benchmark test this to make sure of that.

---

Ryan Dunn
Extemporaneous Mumblings
The .NET Developer's Guide to Directory Services Programming

This is the best solution I could come up with that combines using the 2.0 Forest class AND the GC for paged searches. A bit of a hack but so far this is working ok.

DirectoryEntry de = null;

if (this.ADCred != null && ADCred.Domain != null)

{

DirectoryContext dc = new DirectoryContext(

DirectoryContextType.Forest,

ADCred.Domain,

ADCred.DomainDomainUser,

ADCred.Password);

using (Forest f = Forest.GetForest(dc))

{

if (f != null)

de = f.RootDomain.GetDirectoryEntry();

}

}

else

{

using (Forest f = Forest.GetCurrentForest())

{

if (f != null)

de = f.RootDomain.GetDirectoryEntry();

}

}

using (de)

{

if (de != null)

{

searchRoot = de.Path;

if (searchRoot.Contains(ADSearch.LDAP_PROVIDER))

{

searchRoot = searchRoot.Replace(ADSearch.LDAP_PROVIDER, ADSearch.GC_PROVIDER);

}

}

}

With using the GC, there is one other dilemma that I can think of, and that is attributes of GC objects (or lack thereof). The GC is great for doing comprehensive searches throughout the forest that are fast, however what to do when the objects you find don't have the attributes your are looking for? My example is AD printQueue objects. On my GC searches I find the printQueue objects OK, but they do not contain the PortName attribute I am looking for, and that's even if I add PortName to the PropertiesToLoad field of DirectorySearcher.

My current workaround is using the object's AdsPath, replacing 'GC:' with 'LDAP:', and then doing a BASE search on that object with the required properties loaded. This works ok and I get my properties, but is less than optimal! Yet another tradeoff between the GC and LDAP providers.

 

There is another trick available to you, but it requires you to jump ship to SDS.Protocols, so you might not like having that much rework.  AD 2003 supports this thing called a "phantom root" query, which allows you to do GC-like query across multiple NCs simultaneously using the LDAP provider and not being subject to the limitations of the partial attribute set or referral chasing.

Unfortunately, phantom root isn't exposed in ADSI at all, so it isn't in SDS DirectorySearcher.  However, you can do it with SDS.Protocols using the appropriate control on your query.  I wish I had a handy sample.