AD LDS, droit d'accès pour le sinterrogations LDAP
Discussion générale
Toutes les réponses
-
Bonjour,
Vous avez besoin de permissions pour interroger le répertoire AD.
Sinon, vous pouvez permettre les recherches anonymes : (article qui s’applique à Windows Server 2003).
‘’
Anonymous queries
By default, anonymous LDAP operations to Active Directory, other than rootDSE searches and binds, are not permitted in Windows Server 2003. (Active Directory in Windows 2000 Server accepts anonymous requests; a successful result depends on objects having correct user permissions in Active Directory.)
To enable anonymous binding to Active Directory in Windows Server 2003, you must change the seventh character of the dsHeuristics attribute on the following directory object:
CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,Root domain in forest
Valid values for the dsHeuristics attribute are 0 and 2. By default, the dsHeuristics attribute does not exist, but its internal default is 0. If you set the seventh character to 2, anonymous clients can perform any operation that is permitted by the access control list (ACL). If the attribute is already set, do not modify any bits in the dsHeuristics string other than the seventh bit. If the value is not set, make sure that you provide the leading zeros up to the seventh bit. You can use Adsiedit.msc to make the change to the dsHeuristics attribute.
After you set the dsHeuristics attribute, if you want anonymous users to be able to query Active Directory, you can enable anonymous access to specific directory objects. Users gain anonymous access to Active Directory objects through Anonymous Logon, which is a special security identifier (SID) that is used to represent anonymous network callers that perform an LDAP bind with NULL credentials.
Performing an LDAP Search
LDAP searches are the most common LDAP operations that are performed against an Active Directory domain controller. An LDAP search retrieves information about all objects within a specific scope that have certain characteristics, for example, the telephone number of every person in a department.
The following parameters are used in LDAP to accomplish an LDAP search:
- Search base (the distinguished name of the search base object). Defines the location in the directory from which the LDAP search begins.
‘’
Merci de nous tenir au courant,
Cordialement,
Roxana
Roxana PANAIT, MSFT
Votez! Appel à la contribution
Nous vous prions de considérer que dans le cadre de ce forum on n’offre pas de support technique et aucune garantie de la part de Microsoft ne peut être offerte.
