{"id":77,"date":"2009-09-11T01:50:31","date_gmt":"2009-09-11T00:50:31","guid":{"rendered":"https:\/\/harun.se\/blog\/?p=77"},"modified":"2009-09-11T02:01:47","modified_gmt":"2009-09-11T01:01:47","slug":"how-to-use-ldifde-to-export-and-to-import-directory-objects","status":"publish","type":"post","link":"https:\/\/harun.se\/blog\/?p=77","title":{"rendered":"HOW TO USE LDIFDE to export and to import directory objects"},"content":{"rendered":"

<\/strong>This is a step-by-step guide to import and export Organizational Units (OUs) and user accounts from one Active Directory to another. For this example, “SourceDomain” is the name of the domain from which objects are exported and “TargetDomain” is the name of the domain in which objects are imported. LDIFDE can also be used to import most third-party folders to Active Directory. <\/span><\/p>\n

How to Export the organizational units from the source domain<\/span><\/strong><\/div>\n

\u00a0<\/p>\n

<\/strong><\/p>\n

Log on as Administrator in the Source Domain. If you log on using an account that does not have administrative privileges, you may not be able to perform export and import operations against the Active Directory. <\/span><\/p>\n

At the command prompt, type: <\/span><\/p>\n

ldifde -f exportOu.ldf -s DC01<\/em> -d “dc=SourceDomain,dc=se” -p subtree -r “(objectCategory=organizationalUnit)” -l “cn,objectclass,ou” <\/span><\/p>\n

NOTE: <\/span><\/strong><\/div>\n

DC01 is the Server name of the\u00a0Source Domain Controller<\/span><\/p>\n

<\/strong><\/p>\n

This command exports all OUs except domain controllers into a file named ExportOU.ldf. <\/span><\/p>\n

How to Export the user accounts from the source domain<\/span><\/strong><\/div>\n

\u00a0<\/p>\n

<\/strong><\/p>\n

At the command prompt, type: <\/span><\/p>\n

ldifde -f Exportuser.ldf -s DC01<\/em> -d “dc=SourceDomain,dc=se” -p subtree -r “(&(objectCategory=person)(objectClass=User)(givenname=*))” -l “cn,givenName,objectclass,samAccountName”<\/span> <\/span><\/p>\n

NOTE: <\/span><\/strong><\/div>\n

DC01 is the Server name of the Source\u00a0 Domain Controller<\/span><\/p>\n

<\/strong><\/p>\n

This command exports all users in the Source Domain into a file named Exportuser.ldf. If you do not have all the required attributes, the import operation does not work. The attributes objectclass<\/strong> and samAccountName<\/strong> are required, but more can be added as needed.<\/span><\/div>\n

INFO:<\/strong> Built-in accounts, such as Administrator, do not have a given name. By default, the LDAP filter used above does not export those accounts. LDIFDE does not support exporting passwords.<\/p>\n

INFO:<\/strong> When you omit the -s<\/strong> parameter, LDIFDE chooses a global catalog for exports. Depending on the domain controller placement, this server might be a domain controller for a different domain, and exports might fail. You see this when you examine the output of LDIFDE. In this case, specify a local domain controller of the domain in which the objects are hosted.<\/p>\n

<\/span><\/p>\n

Import the organizational units from SourceDomain to TargetDomain<\/span><\/strong><\/div>\n

\u00a0<\/p>\n

<\/strong><\/p>\n

Log on as an Administrator in the TargetDomain domain. If you log on using an account that does not have administrative privileges, you may not be able to perform export and import operations against the Active Directory. <\/span><\/p>\n

Open the file Exportou.ldf using Notepad. <\/span><\/p>\n

In Notepad, on the Edit<\/strong> menu, click Replace<\/strong>. <\/span><\/p>\n

In the Find what box type, SourceDomain. In the Replace with box type, TargetDomain. <\/span><\/p>\n

Click Replace All. <\/span><\/p>\n

After you verify that the domain names are replaced, save, and then close the file. <\/span><\/p>\n

At the command prompt, type: <\/span><\/p>\n

ldifde -i -f ExportOU.ldf -s DC02<\/span><\/p>\n

NOTE: <\/span><\/em><\/strong><\/em><\/div>\n

DC02 is the Server name of the Target Domain Controller<\/span><\/p>\n

<\/em><\/strong><\/p>\n

You should see a message stating the number of entries that have been modified and that the command completed successfully.<\/span><\/div>\n

<\/em>INFO:<\/strong> In this situation, you must complete the first step prior to completing the second step so that the OUs are available to contain the users.<\/p>\n

<\/span><\/p>\n

How to Import the users from SourceDomain to TargetDomain<\/span><\/strong><\/div>\n

\u00a0<\/p>\n

<\/strong><\/p>\n

Open the file Exportuser.ldf using Notepad. <\/span><\/p>\n

In notepad, open the Edit<\/strong> menu and click Replace<\/strong>.<\/span><\/div>\n

INFO:<\/strong> Remember that in this example, “SourceDomain” is the name of the domain from which objects are exported and “TargetDomain” is the name of the domain to which objects are imported. You will replace “SourceDomain” with the name of the domain you exported from and you will have to replace “TargetDomain” with the domain you are importing to.<\/p>\n

<\/span><\/p>\n

In the Find what box type, SourceDomain. In the Replace with box, type TargetDomain. <\/span><\/p>\n

Click Replace All. <\/span><\/p>\n

After you verify that the domain names are replaced, save, and then close the file. <\/span><\/p>\n

At the command prompt, type: <\/span><\/p>\n

ldifde -i -f Exportuser.ldf -s\u00a0 DC02\u00a0\u00a0 <\/span><\/span><\/p>\n

NOTE:<\/span> DC02 is the Server name of the Target Domain Controller<\/em> <\/span><\/p>\n

View the newly created contacts using either the Active Directory Users and Computers snap-in tool or using the Windows Address Book. <\/span><\/p>\n

\u00a0<\/p>\n

INFO:<\/span><\/strong><\/div>\n

: Because LDIFDE does not export passwords, when the users are imported into the directory, the account is disabled and the password is set to null. This is done for security reasons. Also, the account option “User must change password at next logon” is selected. <\/span><\/p>\n

How to Export objects from an entire forest<\/span><\/strong><\/div>\n

\u00a0<\/p>\n

<\/strong><\/strong><\/p>\n

If you need to export OUs, users, and groups from an entire forest, you may either run the above LDIFDE export commands against each domain in the forest, or alternatively, run the query once against the global catalog (GC). To do this, ensure that the domain controller that is specified by the -s switch is a GC, and additionally, specify the GC port using the -t switch. The GC port number is 3268.<\/span><\/div>\n

For example, to perform the export operation outlined against a GC, the LDIFDE command would be:<\/p>\n

<\/span><\/p>\n

ldifde -f Exportuser.ldf -s DC01<\/em> -t 3268 -d “dc=SourceDomain,dc=se” -p subtree -r “(&(objectCategory=person)(objectClass=User)(givenname=*))” -l “cn,givenName,objectclass,sAMAccountName” <\/span><\/p>\n

\u00a0<\/p>\n

\u00a0<\/p>\n

NOTE: <\/span><\/strong><\/div>\n

DC01 is the Server name of the Source Domain Controller<\/span><\/p>\n

INFO:<\/span><\/strong><\/div>\n

<\/p>\n

To Modify attributes in AD it is very important that the following format be followed for the import file, especially the “-” on a single line followed by a completely blank line on the next line. To import this file all you need to do is run: ldifde -i -f Import.ldf -s Server<\/em>.<\/span><\/span><\/div>\n

Sample Import\/Modify File Format:<\/p>\n

dn: CN=Jane Doe,OU=UserAccounts,DC=harun,DC=se<\/span><\/span><\/span><\/div>\n

<\/span>changetype: modify<\/span><\/p>\n

replace: extensionAttribute1<\/span><\/p>\n

extensionAttribute1: Staff<\/span><\/p>\n

–<\/span><\/p>\n

dn: CN=John Doe,OU=UserAccounts,DC=harun,DC=se<\/span><\/p>\n

changetype: modify<\/span><\/p>\n

replace: extensionAttribute1<\/span><\/p>\n

extensionAttribute1: Staff<\/span><\/p>\n

–<\/span><\/p>\n

\u00a0<\/p>\n

How to Import multivalued attributes <\/span><\/strong><\/div>\n

<\/span><\/span>\u00a0<\/p>\n

<\/strong><\/strong><\/strong><\/p>\n

Import files with multivalued attributes have the form of:
\ndn: distinguishedName<\/em>
\nchangetype: modify
\nreplace: attribute
\nmodify replace: attribute<\/em> [this is the attribute to be changed]
\nattribute: value1<\/em>
\nattribute: value2<\/em>
\nattribute: valueN<\/em> [where N is the next value] – [hyphen, required to terminate input file]
\nexample:
\ndn: CN=Connector for Lotus Notes (EX1),CN=Connections,CN=First Routing Group,CN=Routing Groups,CN=First Administrative Group,CN=Administrative Groups,CN=HARUN,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=harun,DC=se changetype: modify replace: msExchExportContainersLinked msExchExportContainersLinked: OU=GroupWise Users,DC=harun,DC=se msExchExportContainersLinked: OU=AD Users,DC=harun,DC=se msExchExportContainersLinked: CN=Users,DC=harun,DC=se<\/span><\/span><\/p>\n

LDIFDE Parameters<\/strong>
\n-i\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Turn on Import Mode (The default is Export)
\n-f filename\u00a0\u00a0\u00a0\u00a0 Input or Output filename
\n-s servername\u00a0\u00a0 The server to bind to
\n-c FromDN ToDN\u00a0 Replace occurrences of FromDN to ToDN
\n-v\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Turn on Verbose Mode
\n-j\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Log File Location
\n-t\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Port Number (default = 389)
\n-?\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Help
\n\u00a0\u00a0\u00a0\u00a0
\nExport Parameters<\/strong>
\n-d RootDN\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 The root of the LDAP search (Default to Naming Context)
\n-r Filter\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 LDAP search filter (Default to “(objectClass=*)”)
\n-p SearchScope\u00a0 Search Scope (Base\/OneLevel\/Subtree)
\n-l list\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 List of attributes (comma separated) to look for in an LDAP
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 search.
\n-o list\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 List of attributes (comma separated) to omit from input
\n-g\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Disable Paged Search
\n-m\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Enable the SAM logic on export
\n-n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Do not export binary values
\n\u00a0\u00a0\u00a0\u00a0
\n<\/span>Import Parameter
\n<\/strong>-k\u00a0\u00a0\u00a0\u00a0\u00a0 The import will go on ignoring ‘Constraint Violation’ and ‘Object
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Already Exists’ errors
\n\u00a0\u00a0\u00a0\u00a0
\nCredentials Parameters<\/strong><\/span><\/span>
\n-a\u00a0\u00a0\u00a0\u00a0\u00a0 Sets the command to run using the supplied user distinguished name
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 and password. For example: “cn=yourname,dc=yourcompany,dc-com
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 password”\u00a0
\n-b\u00a0\u00a0\u00a0\u00a0\u00a0 Sets the command to run as username domain password. The default is
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 to run using the <\/span>credentials of the currently logged on user.<\/span><\/span><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

This is a step-by-step guide to import and export Organizational Units (OUs) and user accounts from one Active Directory to another. For this example, “SourceDomain” is the name of the domain from which objects are exported and “TargetDomain” is the name of the domain in which objects are imported. LDIFDE can also be used to […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[17],"tags":[],"_links":{"self":[{"href":"https:\/\/harun.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/77"}],"collection":[{"href":"https:\/\/harun.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/harun.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/harun.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/harun.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=77"}],"version-history":[{"count":8,"href":"https:\/\/harun.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/77\/revisions"}],"predecessor-version":[{"id":84,"href":"https:\/\/harun.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/77\/revisions\/84"}],"wp:attachment":[{"href":"https:\/\/harun.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=77"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/harun.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=77"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/harun.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=77"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}