Windows Server 2003 : Using Automation to Manage Group Accounts

Using LDIFDE

The Lightweight Directory Access Protocol (LDAP) Data Interchange Format (LDIF) is a draft Internet standard for a file format that may be used to perform batch operations against directories that conform to the LDAP standards. LDIF can be used to export and import data, allowing batch operations such as add, create, and modify to be performed against the Active Directory. A utility program called LDIFDE is included in Windows Server 2003 to support batch operations based on the LDIF file format standard.

LDIFDE is a command-line utility, available on all Windows Server 2003 editions. From a command prompt or command shell, you run the LDIFDE utility with the appropriate command switches. Figure 1 lists the primary commands used with LDIFDE displayed by typing ldifde /? at the command prompt.

Table 1 details the primary LDIFDE commands.

Creating Groups with DSADD

To add a group, use the syntax

dsadd group GroupDN...

The GroupDN... parameter is one or more distinguished names for the new user objects. If a DN includes a space, surround the entire DN with quotation marks. The GroupDN... parameter can be entered one of the following ways:

• By piping a list of DNs from another command, such as dsquery.

• By typing each DN on the command line, separated by spaces.

• By leaving the DN parameter empty, at which point you can type the DNs, one at a time, at the keyboard console of the command prompt. Press ENTER after each DN. Press CTRL+Z and ENTER after the last DN.

The DSADD GROUP command can take the following optional parameters after the DN parameter:

• -secgrp {yes | no} determines whether the group is a security group (yes) or a distribution group (no). The default value is yes.

• -scope {l | g | u} determines whether the group is a domain local (l), global (g, the default), or universal (u).

• -samid SAMName

• desc Description

• -memberof GroupDN... specifies groups to which to add the new group.

• -members MemberDN... specifies members to add to the group.

You can add -s, -u, and -p parameters to specify the domain controller against which DSADD will run, and the user name and password—the credentials—that will be used to execute the command.

• {-s Server | -d Domain}

• -u UserName

• -p {Password | *}

Modifying Groups with DSMOD

The DSMOD command, is used to modify objects in Active Directory. To modify a group, use the syntax

dsmod group GroupDN...

The command takes many of the same switches as DSADD, including -samid, -desc, -secgrp, and -scope. Typically, though, you won’t be changing those attributes of an existing group. Rather, the most useful switches are those that let you modify the membership of a group, specifically

• -addmbr Member... adds members to the group specified in Group

• -rmmbr Member... removes members from the group specified in Group

where, as with all directory service commands, the DN is the full, distinguished name of another Active Directory object, surrounded by quotes if there are any spaces in the DN.

Practice: Using LDIFDE to Manage Group Accounts

In the following exercises, you list the options available for LDIFDE, export users from the Active Directory, and create a group object in the directory.

Exercise 1: Starting LDIFDE

In this exercise, you list the command options available with LDIFDE.

Exercise 2: Exporting the Users from an Organizational Unit

In this exercise, you will export the entire contents of an OU named Marketing, complete with all its users, from the contoso.com domain.

ldifde -f marketing.ldf -s server01 :
-d "ou=Marketing,dc=contoso,dc=com" :
-p subtree -r : "(objectCategory=CN=Person,CN=Schema,CN=Configuration,:
DC=contoso,DC=com)"

Figure 2 shows the code in action.

This creates a LDIF file named Marketing.ldf by connecting to the server named Server01 and executing a subtree search of the Marketing OU for all objects of the category Person.

Exercise 3: Using LDIFDE to Create a Group

In this exercise, you will use LDIFDE to add a group named Management to the Marketing OU of contoso.com.

dn: CN=Management,OU=Marketing,DC=contoso,DC=com
changetype: add
cn: Management
objectClass: group
samAccountName: Marketing