[ActiveDir] DirectoryServices vb.net is broken.
I have a user with no description attribute. Anyone know why this works? User.Invoke("put", New Object() {"description", txtBxNewDescription.Text}) User.commitChanges but this doesn't User.Properties("Description").Add(txtBxNewDescription.Text) User.commitChanges I get the following error message. ComError {"A constraint violation occurred. (Exception from HRESULT: 0x8007202F)"} System.DirectoryServices.DirectoryServicesCOMException Thanks Yves St-Cyr List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ma/default.aspx
Re: [ActiveDir] DirectoryServices vb.net is broken.
They aren't equivalent. Try using the .Value property instead: user.Properties("description").Value = Description is a funny property in AD in that the schema says that it allows multiple values, but the DS itself will only allow it to contain a single value for backward compatibility with previous DS APIs. That might be part of the problem here. In any event, it is generally always good practice to use the .Value property to set a single value. There is more info on this in ch 6 of our book (www.directoryprogramming.net). Joe K. - Original Message - From: "AD" <[EMAIL PROTECTED]> To: Sent: Thursday, December 28, 2006 10:13 AM Subject: [ActiveDir] DirectoryServices vb.net is broken. I have a user with no description attribute. Anyone know why this works? User.Invoke("put", New Object() {"description", txtBxNewDescription.Text}) User.commitChanges but this doesn't User.Properties("Description").Add(txtBxNewDescription.Text) User.commitChanges I get the following error message. ComError {"A constraint violation occurred. (Exception from HRESULT: 0x8007202F)"} System.DirectoryServices.DirectoryServicesCOMException Thanks Yves St-Cyr List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ma/default.aspx List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ma/default.aspx
RE: [ActiveDir] DirectoryServices vb.net is broken.
It worked. Thanks a million. Hopefully my hair won't take to long to grow back. I bought your book last week from amazon. I currently reading chapter 3. Actually took your example code. See 3.13.vb. Isn't that funny? I thought DirectoryServices was a wrapper to ADSI? Why do you say they are not equivalent? Y They aren't equivalent. Try using the .Value property instead: user.Properties("description").Value = Description is a funny property in AD in that the schema says that it allows multiple values, but the DS itself will only allow it to contain a single value for backward compatibility with previous DS APIs. That might be part of the problem here. In any event, it is generally always good practice to use the .Value property to set a single value. There is more info on this in ch 6 of our book (www.directoryprogramming.net). Joe K. - Original Message - From: "AD" <[EMAIL PROTECTED]> To: Sent: Thursday, December 28, 2006 10:13 AM Subject: [ActiveDir] DirectoryServices vb.net is broken. I have a user with no description attribute. Anyone know why this works? User.Invoke("put", New Object() {"description", txtBxNewDescription.Text}) User.commitChanges but this doesn't User.Properties("Description").Add(txtBxNewDescription.Text) User.commitChanges I get the following error message. ComError {"A constraint violation occurred. (Exception from HRESULT: 0x8007202F)"} System.DirectoryServices.DirectoryServicesCOMException Thanks Yves St-Cyr List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ma/default.aspx List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ma/default.aspx <>
Re: [ActiveDir] DirectoryServices vb.net is broken.
I'm saying that those two are not equivalent functions under the hood. Add typically does a PutEx with the append flag, while Put just does a "put", which is essentially an LDAP "update" operation. I think you would have the same problem if you invoked PutEx and used the Append flag. .Value uses PutEx, but with the ADSI replace flag, which boils down to an LDAP update operation. Aren't all of the layers fun? :) You can dig into the details a little more by using Reflector to reverse compile System.DirectoryServices into your language of choice. That is how Ryan and I learned most of what we know. Figuring out how ADSI calls LDAP is pretty hard unless you have access to the Microsoft source code. Sorry if the example in 3.13 was at all misleading or inconsistent, but I'll stand by the more detailed stuff on attribute modification in Ch 6. Thanks for buying it and I hope it helps more than hurts. There is an inevitable amount of hair loss that must occur with any new LDAP programming project, but hopefully it won't require prescription drugs or surgery to replace. Joe K. - Original Message - From: "AD" <[EMAIL PROTECTED]> To: Sent: Thursday, December 28, 2006 12:06 PM Subject: RE: [ActiveDir] DirectoryServices vb.net is broken. It worked. Thanks a million. Hopefully my hair won't take to long to grow back. I bought your book last week from amazon. I currently reading chapter 3. Actually took your example code. See 3.13.vb. Isn't that funny? I thought DirectoryServices was a wrapper to ADSI? Why do you say they are not equivalent? Y They aren't equivalent. Try using the .Value property instead: user.Properties("description").Value = Description is a funny property in AD in that the schema says that it allows multiple values, but the DS itself will only allow it to contain a single value for backward compatibility with previous DS APIs. That might be part of the problem here. In any event, it is generally always good practice to use the .Value property to set a single value. There is more info on this in ch 6 of our book (www.directoryprogramming.net). Joe K. - Original Message - From: "AD" <[EMAIL PROTECTED]> To: Sent: Thursday, December 28, 2006 10:13 AM Subject: [ActiveDir] DirectoryServices vb.net is broken. I have a user with no description attribute. Anyone know why this works? User.Invoke("put", New Object() {"description", txtBxNewDescription.Text}) User.commitChanges but this doesn't User.Properties("Description").Add(txtBxNewDescription.Text) User.commitChanges I get the following error message. ComError {"A constraint violation occurred. (Exception from HRESULT: 0x8007202F)"} System.DirectoryServices.DirectoryServicesCOMException Thanks Yves St-Cyr List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ma/default.aspx List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ma/default.aspx List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ma/default.aspx
RE: [ActiveDir] DirectoryServices vb.net is broken.
That is a problem only on SAM based objects (groups, users, computers). Anything that isn't SAM based can have multiple values. :) That makes it even more fun. -- O'Reilly Active Directory Third Edition - http://www.joeware.net/win/ad3e.htm -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Joe Kaplan Sent: Thursday, December 28, 2006 12:24 PM To: ActiveDir@mail.activedir.org Subject: Re: [ActiveDir] DirectoryServices vb.net is broken. They aren't equivalent. Try using the .Value property instead: user.Properties("description").Value = Description is a funny property in AD in that the schema says that it allows multiple values, but the DS itself will only allow it to contain a single value for backward compatibility with previous DS APIs. That might be part of the problem here. In any event, it is generally always good practice to use the .Value property to set a single value. There is more info on this in ch 6 of our book (www.directoryprogramming.net). Joe K. - Original Message - From: "AD" <[EMAIL PROTECTED]> To: Sent: Thursday, December 28, 2006 10:13 AM Subject: [ActiveDir] DirectoryServices vb.net is broken. I have a user with no description attribute. Anyone know why this works? User.Invoke("put", New Object() {"description", txtBxNewDescription.Text}) User.commitChanges but this doesn't User.Properties("Description").Add(txtBxNewDescription.Text) User.commitChanges I get the following error message. ComError {"A constraint violation occurred. (Exception from HRESULT: 0x8007202F)"} System.DirectoryServices.DirectoryServicesCOMException Thanks Yves St-Cyr List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ma/default.aspx List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ma/default.aspx List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ma/default.aspx
RE: [ActiveDir] DirectoryServices vb.net is broken.
Thanks for the info, I actually understand, and please don't take my comments as a complaint. So far I love the book, there isn't anything out there that comes close to have so much information on directory services. I have been programming with DSS for about 1 year now and let me tell ya, google does not have much when it comes to directory programming. This book will definitely be my first resource. I still have allot to learn and I think Microsoft is also learning because DSS 2.0 has improved 2 fold over 1.1. Can't wait to see framework 3.0. Y From: [EMAIL PROTECTED] on behalf of Joe Kaplan Sent: Thu 28/12/2006 1:46 PM To: ActiveDir@mail.activedir.org Subject: Re: [ActiveDir] DirectoryServices vb.net is broken. I'm saying that those two are not equivalent functions under the hood. Add typically does a PutEx with the append flag, while Put just does a "put", which is essentially an LDAP "update" operation. I think you would have the same problem if you invoked PutEx and used the Append flag. .Value uses PutEx, but with the ADSI replace flag, which boils down to an LDAP update operation. Aren't all of the layers fun? :) You can dig into the details a little more by using Reflector to reverse compile System.DirectoryServices into your language of choice. That is how Ryan and I learned most of what we know. Figuring out how ADSI calls LDAP is pretty hard unless you have access to the Microsoft source code. Sorry if the example in 3.13 was at all misleading or inconsistent, but I'll stand by the more detailed stuff on attribute modification in Ch 6. Thanks for buying it and I hope it helps more than hurts. There is an inevitable amount of hair loss that must occur with any new LDAP programming project, but hopefully it won't require prescription drugs or surgery to replace. Joe K. - Original Message - From: "AD" <[EMAIL PROTECTED]> To: Sent: Thursday, December 28, 2006 12:06 PM Subject: RE: [ActiveDir] DirectoryServices vb.net is broken. It worked. Thanks a million. Hopefully my hair won't take to long to grow back. I bought your book last week from amazon. I currently reading chapter 3. Actually took your example code. See 3.13.vb. Isn't that funny? I thought DirectoryServices was a wrapper to ADSI? Why do you say they are not equivalent? Y They aren't equivalent. Try using the .Value property instead: user.Properties("description").Value = Description is a funny property in AD in that the schema says that it allows multiple values, but the DS itself will only allow it to contain a single value for backward compatibility with previous DS APIs. That might be part of the problem here. In any event, it is generally always good practice to use the .Value property to set a single value. There is more info on this in ch 6 of our book (www.directoryprogramming.net). Joe K. - Original Message - From: "AD" <[EMAIL PROTECTED]> To: Sent: Thursday, December 28, 2006 10:13 AM Subject: [ActiveDir] DirectoryServices vb.net is broken. I have a user with no description attribute. Anyone know why this works? User.Invoke("put", New Object() {"description", txtBxNewDescription.Text}) User.commitChanges but this doesn't User.Properties("Description").Add(txtBxNewDescription.Text) User.commitChanges I get the following error message. ComError {"A constraint violation occurred. (Exception from HRESULT: 0x8007202F)"} System.DirectoryServices.DirectoryServicesCOMException Thanks Yves St-Cyr List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ma/default.aspx List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ma/default.aspx List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ma/default.aspx <>
RE: [ActiveDir] DirectoryServices vb.net is broken.
One last comment Joe, Do you think that is a bug with DSS? That now means depending of the attribute, you have to use different method? Kinda makes it complicated don't you think?. Now I have to "hard code" attribute names in my program. if attribute="description" do this else do it this way. That sucks Microsoft. Y From: [EMAIL PROTECTED] on behalf of Joe Kaplan Sent: Thu 28/12/2006 1:46 PM To: ActiveDir@mail.activedir.org Subject: Re: [ActiveDir] DirectoryServices vb.net is broken. I'm saying that those two are not equivalent functions under the hood. Add typically does a PutEx with the append flag, while Put just does a "put", which is essentially an LDAP "update" operation. I think you would have the same problem if you invoked PutEx and used the Append flag. .Value uses PutEx, but with the ADSI replace flag, which boils down to an LDAP update operation. Aren't all of the layers fun? :) You can dig into the details a little more by using Reflector to reverse compile System.DirectoryServices into your language of choice. That is how Ryan and I learned most of what we know. Figuring out how ADSI calls LDAP is pretty hard unless you have access to the Microsoft source code. Sorry if the example in 3.13 was at all misleading or inconsistent, but I'll stand by the more detailed stuff on attribute modification in Ch 6. Thanks for buying it and I hope it helps more than hurts. There is an inevitable amount of hair loss that must occur with any new LDAP programming project, but hopefully it won't require prescription drugs or surgery to replace. Joe K. - Original Message - From: "AD" <[EMAIL PROTECTED]> To: Sent: Thursday, December 28, 2006 12:06 PM Subject: RE: [ActiveDir] DirectoryServices vb.net is broken. It worked. Thanks a million. Hopefully my hair won't take to long to grow back. I bought your book last week from amazon. I currently reading chapter 3. Actually took your example code. See 3.13.vb. Isn't that funny? I thought DirectoryServices was a wrapper to ADSI? Why do you say they are not equivalent? Y They aren't equivalent. Try using the .Value property instead: user.Properties("description").Value = Description is a funny property in AD in that the schema says that it allows multiple values, but the DS itself will only allow it to contain a single value for backward compatibility with previous DS APIs. That might be part of the problem here. In any event, it is generally always good practice to use the .Value property to set a single value. There is more info on this in ch 6 of our book (www.directoryprogramming.net). Joe K. - Original Message - From: "AD" <[EMAIL PROTECTED]> To: Sent: Thursday, December 28, 2006 10:13 AM Subject: [ActiveDir] DirectoryServices vb.net is broken. I have a user with no description attribute. Anyone know why this works? User.Invoke("put", New Object() {"description", txtBxNewDescription.Text}) User.commitChanges but this doesn't User.Properties("Description").Add(txtBxNewDescription.Text) User.commitChanges I get the following error message. ComError {"A constraint violation occurred. (Exception from HRESULT: 0x8007202F)"} System.DirectoryServices.DirectoryServicesCOMException Thanks Yves St-Cyr List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ma/default.aspx List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ma/default.aspx List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ma/default.aspx <>
Re: [ActiveDir] DirectoryServices vb.net is broken.
I'm not sure if it is a bug or not. Generally, I always use .Value to set a value and only use Add if I'm explicitly trying to add an additional value to a multi-valued attribute that already has values. Same basic approach for Remove. That helps keep me out of trouble. :) It is interesting, because there have been MANY problems with the various techniques used to modify the property cache in S.DS over the years. I think the current design is the least problematic. The issue really stems from the way S.DS tries to represent the property cache as a stateful collection of collections on the DirectoryEntry, but ADSI does this in a "non-stateful" way using Put and PutEx to modify. The other issue has to do with the fact that each ADSI provider does stuff slighly differently under the hood when it talks to the actual API doing the work (LDAP for LDAP, Net* for WinNT, ABO for IIS provider, etc.). The alternative is to just switch over to using System.DirectoryServices.Protocols. That basically talks directly to LDAP via wldap32.dll (like the www.joeware.net tools do, but going through .NET first). However, you tend to have to write more code to do the same thing and learn a lot more about LDAP that you might want to, so it is a two-edged sword. The most difficult things are learning how to use the advanced LDAP controls to do things like paged searches and security descriptor read/modify operations. ADSI tries to make that stuff easy for you. Note also that there is nothing really new and exciting in DS programming in .NET 3.0. The next wave of stuff for DS will be in the next .NET rev that ships with the next Visual Studio. .NET 3.0 is actually the .NET 2.0 runtime with additional assemblies that support WCF, WPF, WWF and CardSpace. Many of the assemblies are unchanged and actually run straight from the .NET 2.0 install directory. The good news is that our book is not out of date for at least another year. :) The next version is supposed to have strongly typed support for users and groups, kind of like S.DS.ActiveDirectory adds strongly typed support for concepts like Forests, Domains, Trusts, Schema, Replication etc. There are a few minor tweaks to ADSI in Windows Vista (remember that ADSI comes with Windows, so it is on a different release cycle than S.DS, which comes with .NET and usually cycles with Visual Studio but sometimes cycles with Windows). However, these are pretty low key. Joe K. - Original Message - From: "AD" <[EMAIL PROTECTED]> To: Sent: Thursday, December 28, 2006 1:40 PM Subject: RE: [ActiveDir] DirectoryServices vb.net is broken. One last comment Joe, Do you think that is a bug with DSS? That now means depending of the attribute, you have to use different method? Kinda makes it complicated don't you think?. Now I have to "hard code" attribute names in my program. if attribute="description" do this else do it this way. That sucks Microsoft. Y From: [EMAIL PROTECTED] on behalf of Joe Kaplan Sent: Thu 28/12/2006 1:46 PM To: ActiveDir@mail.activedir.org Subject: Re: [ActiveDir] DirectoryServices vb.net is broken. I'm saying that those two are not equivalent functions under the hood. Add typically does a PutEx with the append flag, while Put just does a "put", which is essentially an LDAP "update" operation. I think you would have the same problem if you invoked PutEx and used the Append flag. .Value uses PutEx, but with the ADSI replace flag, which boils down to an LDAP update operation. Aren't all of the layers fun? :) You can dig into the details a little more by using Reflector to reverse compile System.DirectoryServices into your language of choice. That is how Ryan and I learned most of what we know. Figuring out how ADSI calls LDAP is pretty hard unless you have access to the Microsoft source code. Sorry if the example in 3.13 was at all misleading or inconsistent, but I'll stand by the more detailed stuff on attribute modification in Ch 6. Thanks for buying it and I hope it helps more than hurts. There is an inevitable amount of hair loss that must occur with any new LDAP programming project, but hopefully it won't require prescription drugs or surgery to replace. Joe K. - Original Message - From: "AD" <[EMAIL PROTECTED]> To: Sent: Thursday, December 28, 2006 12:06 PM Subject: RE: [ActiveDir] DirectoryServices vb.net is broken. It worked. Thanks a million. Hopefully my hair won't take to long to grow back. I bought your book last week from amazon. I currently reading chapter 3. Actually took your example code. See 3.13.vb. Isn't that funny? I thought DirectoryServices was a wrapper to ADSI? Why do you say they are not equivalent? Y They aren't equivalent. Try using the .Value property instead: user.Properties(&
RE: [ActiveDir] DirectoryServices vb.net is broken.
Thanks for the explanation Joe. I am currently on chapter three of your book. Can't read it fast enough. Do you know if 'deUser.commitchanges' is smart enough not to send an update request to AD if the collection is not dirty? Thanks Y From: [EMAIL PROTECTED] on behalf of Joe Kaplan Sent: Thu 28/12/2006 4:10 PM To: ActiveDir@mail.activedir.org Subject: Re: [ActiveDir] DirectoryServices vb.net is broken. I'm not sure if it is a bug or not. Generally, I always use .Value to set a value and only use Add if I'm explicitly trying to add an additional value to a multi-valued attribute that already has values. Same basic approach for Remove. That helps keep me out of trouble. :) It is interesting, because there have been MANY problems with the various techniques used to modify the property cache in S.DS over the years. I think the current design is the least problematic. The issue really stems from the way S.DS tries to represent the property cache as a stateful collection of collections on the DirectoryEntry, but ADSI does this in a "non-stateful" way using Put and PutEx to modify. The other issue has to do with the fact that each ADSI provider does stuff slighly differently under the hood when it talks to the actual API doing the work (LDAP for LDAP, Net* for WinNT, ABO for IIS provider, etc.). The alternative is to just switch over to using System.DirectoryServices.Protocols. That basically talks directly to LDAP via wldap32.dll (like the www.joeware.net tools do, but going through .NET first). However, you tend to have to write more code to do the same thing and learn a lot more about LDAP that you might want to, so it is a two-edged sword. The most difficult things are learning how to use the advanced LDAP controls to do things like paged searches and security descriptor read/modify operations. ADSI tries to make that stuff easy for you. Note also that there is nothing really new and exciting in DS programming in .NET 3.0. The next wave of stuff for DS will be in the next .NET rev that ships with the next Visual Studio. .NET 3.0 is actually the .NET 2.0 runtime with additional assemblies that support WCF, WPF, WWF and CardSpace. Many of the assemblies are unchanged and actually run straight from the .NET 2.0 install directory. The good news is that our book is not out of date for at least another year. :) The next version is supposed to have strongly typed support for users and groups, kind of like S.DS.ActiveDirectory adds strongly typed support for concepts like Forests, Domains, Trusts, Schema, Replication etc. There are a few minor tweaks to ADSI in Windows Vista (remember that ADSI comes with Windows, so it is on a different release cycle than S.DS, which comes with .NET and usually cycles with Visual Studio but sometimes cycles with Windows). However, these are pretty low key. Joe K. - Original Message - From: "AD" <[EMAIL PROTECTED]> To: Sent: Thursday, December 28, 2006 1:40 PM Subject: RE: [ActiveDir] DirectoryServices vb.net is broken. One last comment Joe, Do you think that is a bug with DSS? That now means depending of the attribute, you have to use different method? Kinda makes it complicated don't you think?. Now I have to "hard code" attribute names in my program. if attribute="description" do this else do it this way. That sucks Microsoft. Y From: [EMAIL PROTECTED] on behalf of Joe Kaplan Sent: Thu 28/12/2006 1:46 PM To: ActiveDir@mail.activedir.org Subject: Re: [ActiveDir] DirectoryServices vb.net is broken. I'm saying that those two are not equivalent functions under the hood. Add typically does a PutEx with the append flag, while Put just does a "put", which is essentially an LDAP "update" operation. I think you would have the same problem if you invoked PutEx and used the Append flag. .Value uses PutEx, but with the ADSI replace flag, which boils down to an LDAP update operation. Aren't all of the layers fun? :) You can dig into the details a little more by using Reflector to reverse compile System.DirectoryServices into your language of choice. That is how Ryan and I learned most of what we know. Figuring out how ADSI calls LDAP is pretty hard unless you have access to the Microsoft source code. Sorry if the example in 3.13 was at all misleading or inconsistent, but I'll stand by the more detailed stuff on attribute modification in Ch 6. Thanks for buying it and I hope it helps more than hurts. There is an inevitable amount of hair loss that must occur with any new LDAP programming project, but hopefully it won't require prescription drugs or surgery to replace. Joe K. - Original Message - From: "AD" <[EMAIL PROTECTED]> To: Sent: Thursday, December 28, 2006 12:06 PM Subject: RE: [ActiveDir] DirectoryServices vb
Re: [ActiveDir] DirectoryServices vb.net is broken.
It doesn't do the change tracking, except with some special case stuff in terms of how the new security descriptor stuff works. However, ADSI itself might track that for you. Basically, CommitChanges calls SetInfo, so if the underlying IADs is clever enough to not send an LDAP request if there are no mods, then the result is likely no network traffic. Try it with ethereal and see. :) If I were to guess, my guess would be that if there are no modification operations queued up in the property cache, then no LDAP modification operations would be sent. It is an interesting question and one that I never really thought much about before, so don't be disappointed when you don't find it discussed in ch 3 or 6. :) Joe K. - Original Message - From: "AD" <[EMAIL PROTECTED]> To: Sent: Tuesday, January 02, 2007 10:30 AM Subject: RE: [ActiveDir] DirectoryServices vb.net is broken. Thanks for the explanation Joe. I am currently on chapter three of your book. Can't read it fast enough. Do you know if 'deUser.commitchanges' is smart enough not to send an update request to AD if the collection is not dirty? Thanks Y List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ma/default.aspx