Adding a AD user with ASP.NET

I have some code that I have used to create a new user in my AD:

------------------------------------------------------------------------
Private Shared Sub AddUser(ByVal strDoamin As String, ByVal strLogin As String, ByVal strPwd As String)
Dim obDirEntry As DirectoryEntry = Nothing
Try
obDirEntry = New DirectoryEntry("WinNT://" + strDomain)
Dim entries As DirectoryEntries = obDirEntry.Children
Dim obUser As DirectoryEntry = entries.Add(strLogin, "User")
obUser.Properties("FullName").Add("Amigo")
Dim obRet As Object = obUser.Invoke("SetPassword", strPwd)
obUser.CommitChanges
Catch ex As Exception
Throw
End Try
End Sub

Shared Sub Main(ByVal args As String())
AddUser("<domin Name>", "<user name>", "<password>")
End Sub
------------------------------------------------------------------------

The problems I'm running into are:

1. How do I make this insert the new user into an alternative AD OU? Do I need to use "LDAP://..." with the path to the OU (OU=Whatever,DC=whatever,DC=com) instead of "WinNt://" for the root?

2. How do I populate the different fields of the user account? For example if the user name is "Steve Doe" how is "Steve" populated into the "First Name" field of the AD account and so on?

3. How would I set this application up so that only certain people in AD security groups (using the current logged in account) can create the new user account? So if Jim (a domain user) tries to add a user it will be rejected but Rick (a member of the domain admins) will be able to.

I know these are tough questions but I'm having no luck with any reference material I'm finding on the web.

Thank you for any input.

Dale

1) It's been a while, but I think this is the case. If I remember correctly, you just need to get the OU and add the user to that entry via DirectoryEntry.Children.Add. This returns the new DirectoryEntry object which can be used to set the other properties of the user object.

You should be able to use LDAP in either case.

2) You'll need to use the AD schema (http://msdn2.microsoft.com/en-us/library/ms675085.aspx)names of the properties. For example, "First Name" is really "Given Name" (givenName) and "Last Name" is really "SurName" (sn). See this page (http://msdn2.microsoft.com/en-us/library/ms677980.aspx) for a mapping of the User Properties dialog to the AD properties.

3) You would need to configure the security groups in AD correctly.

One thing to keep in mind is that in order to create accounts you must be either running under a suitable account (i.e. domain account) or provide the credentials to a suitable account when retrieving the DirectoryEntry object for your OU. ASPNET and NETWORKSERVICE do NOT have these permissions since they are not part of the domain.