Leveraging Command Line Utilities (CLU) to work with Active Directory — Part Two – LDIFDE
This is the second of a two-part series on managing and manipulating LDAP data structures. The easiest example of this is Microsoft’s Active Directory. This will be the directory structure I’ll use in this article.
The intent of this article is to provide the readers with a solid, base foundation on what the tool LDIFDE is and how to use it.
To understand the meaning of LDIFDE, break it into three parts: L- DIF – DE. The L stands for LDAP, this component embraces attributes like objectclass which you will be modifying. DIF means data interchange format which explains what happens when the attributes are imported or exported from active directory. DE is the data exchange, think of the DE as the engine which feeds on .ldf files and transfers objects into active directory.
Another way of looking at LDIFDE is that it is an executable in the systemrootsystem32 folder that feeds on text files and thus makes bulk changes to active directory. Yet another view of LDIFDE is that it is a tool for modifying user accounts or exchange objects in your domain.
How does LDIFDE compare with CSVDE?
LDIFDE’s strength is that it can modify or delete objects in active directory where as CSVDE can only add objects. Whilst the syntax is almost identical in both programs, CSVDE’s data files are much easier to manipulate because, as its name suggests, CSV files are understood by spreadsheets.
One other major difference between the two utilities, are the file structures the tools format the data to. With CSVDE, the AD records – or objects – are formatted in a comma separated value structure, where an objects fields and values are contained on one line, but separated by commas. The very top line is reserved for the LDAP filed name titles.
With LDIFDE formatted files, each AD object or record has fields and their data on each line – NOT separated by commas. Each line starts with the LDAP field name, then the data or value of that field. This results in a file much larger than a CSVDE file even though the quantity of records are the same. Also note that a blank, empty line or row is present between each objects "paragraph" of information.
LDIFDE Basics
Introduction to Export – or How to get information out of Active Directory
Starting with an Export operation is often the easiest way to get acclimated with how the LDIFDE tool works. There are lots of syntax-related issues and multiple switches involved, so learning the syntax is critical. Exporting is easier than importing, so we’ll start with Exporting information.
A note about security – by default, most users accessing Active Directory will have the necessary permissions to Read from AD. So Exporting will likely not be a problem due to lack of permissions. However, Importing to AD – or writing to AD – this will require, of course, proper AD permissions to the domain and/or OU the objects will be written or modified to. You will need to assign yourself proper permissions, or have someone assign for you the proper permissions. You can also log on to the domain as an account having these permissions.
One last note on syntax – just like with the CSVDE tool, the LDIFDE tool will echo syntax-related help by typing the command with a /? help switch.
LDIFDE Export Example 1
To export the active directory objects in your domain into a file called AD_Export.ldf:
1. Connect to a Active Directory domain by simply logging on to the domain.
2. Open a command prompt by typing CMD from the Start > Run menu.
3. Type: ldifde -f AD_Export.ldf (of course, you may provide a file name of any first name and last name. If you use .txt as the extension, then most text editing tools will recognize the file immediately).
In this simple example, the -f switch references a file. The syntax for the CSVDE tool is virtually 100% identical to the LDIFDE tool. LDIFDE has a few more switches however, that we’ll see.
In this example, you are creating a file called AD_Export.ldf with the contents of the AD domain you are connected to.
You can use Notepad to view the contents of the file, but using Microsoft’s Excel is much better. Simply open Excel, choose File > Open, and change the file types from XL* or XL? to text files. Make sure you select only the Tab delimiter.
LDIFDE Export Example 2
The first example created a file with likely more information that you cared for. We want to filter the results to a more manageable data set. We’ll refine our output using the -n and -m switches.
1. Connect to a Active Directory domain by simply logging on to the domain.
2. Open a command prompt by typing CMD from the Start > Run menu.
3. Type the command: LDIFDE -f AD_Export_MN.ldf -m -n
4. Open this file in either Notepad or Excel to view the contents.
Now, much less data will be presented for each record. The -m and -n switches exclude some extra AD-specific data, but you will still likely see more information than you want. Specifically, the -m switch enables "SAM logic" which simply means that you will receive less information, or less system-generated information, leaving information related to what an admin may provide rather than what the AD system would provide. The -n switch will prohibit exporting the binary values for the objects – again, not information the admin would have provided anyway.
LDIFDE Export Filters – -l and -o
When you run the LDIFDE -f AD_Export.ldf, you get overrun with data. The answer is to add switches which extract only the fields you need. The best method is to include only the attributes you want to export into your .ldp file. The alternative is to try and filter out those fields that you do not want and that is easier said than done. Which ever method you choose, you must understand the LDAP attributes to select the correct data.
LDIFDE Export Example 3
The purpose of LDIFDE -l is to select solely the LDAP attributes you need and so reduce the number of fields in the .ldf file.
Once you’ve connected to the domain and opened the command prompt, type:
LDIFDE -f AD_Export_l.ldf -l "DN, objectClass" (note: the DN and objectClass verbiage is not case-sensitive – just make sure to use the quotes)
The -l switch indicates you want a list of attributes, comma separated, to look for in an LDAP search. In this case, we’re interested in exporting the Distinguished Names and objectClass – or types of objects – from AD. ObjectClass examples are organizationalUnit, container, top, person, user, etc.
Of course, the key to using the -l switch is to know the proper LDAP field names. In our example, DN means Distinguished Name.
LDIFDE Export Example 4
In this example, we’ll use an exclude method of filtering. The purpose of LDIFDE -o is to remove unwanted fields in the LDIFDE export. This is the opposite philosophy of the first example, here you output all the fields, except those in the LDAP statement.
Open a command prompt and type:
LDIFDE -f AD_Export_o.ldf -o "instancetype, whenCreated, whenChanged, USNCreated, USNChanged, maxPwdAge, minPwdAge, subrefs, objectCategory"
Remember, the -o list switch tells the LDIFDE tool which fields to omit – not the fields to include. Contrast this with the -l switch which tells the tool which fields to include.
Often with more complicated commands creating a log will capture information you can later use. By incorporating the -j switch you can capture in a log file the echo generated from the command. So, to return to our earlier example, note by adding the -j switch with the drive and folder, a log file will be created called "ldifde.log". See my example below:
LDIFDE -f AD_Export_o.ldf -o "instancetype, whenCreated, whenChanged, USNCreated, USNChanged, maxPwdAge, minPwdAge, subrefs, objectCategory" -j c:
Export Filter -r
If you run a basic export command like: LDIFDE -f AD_Export.ldf, you get swamped with data. One solution is to add the -r switch, which reduces the number of accounts exported. The -r switch controls the type of object you get in the data file; for example: "(objectclass=computer)" means you solely get computers an no users, groups or other unwanted objects.
The purpose of the -r switch is to remove all the objects that you DO NOT want.
LDIFDE Export Example 5
LDIFDE -f AD_Export_r.ldf -r "(objectClass=user)"
It is interesting to note that Microsoft considers computers part of the class "users", so when you specify users as the objectClass, you will also get computer objects as well.
LDIFDE Export Example 6
Using the "&" symbol to combine statements can be very valuable. You can also filter on the "cn" specification and use wildcard characters. Let’s use an example.
LDIFDE -f AD_Export_r.ldf -r "(&(objectClass=user)(cn=a*))"
This command creates a file only to include User objects which has a common name that starts with the letter "a". Note the & symbol near the beginning of the string not in the middle. For example, this in incorrect and will not work:
"((objectClass=user)&(cn=a*))" EXAMPLE OF BAD SYNTAX
The logic operators go at the beginning of the string.
LDIFDE Export Example 7
Combining two switches with the -l and -r switches
LDIFDE -f AD_Export_l_r.ldf -l "DN, objectClass, objectCategory, name, sn, cn, givenName, sAMAccountName, description" -r "(&(objectClass=user)(cn=a*))"
LDIFDE Import Basics
Why LDIFDE -i is powerful yet so complicated
Filenames
LDIFDE -i needs the -f filename switch to acquire the import data. The situation is that not only must the file have the correct syntax, but also the LDAP attributes must be in the .ldf format. Choose Notepad because it will prepare the data perfectly. Avoid more sophisticated programs like Excel because they insert extra tabs, commas or speech marks into the data, These alien formats prevent LDIFDE interpreting the data and as a result, the import fails.
Changetype
One of the benefits of LDIFDE over CSVDE is that you can manipulate data in active directory. To make these changes use the ‘changetype:’ command. There are three changetype commands, ADD, Delete, or Modify. The way it works is by placing the changetype: verb in the .ldf file. I recommend starting with the simpler changetype: verb Add – then learn how Delete and Modify works.
Passwords
LDIFDE can change or set passwords. For security reasons the passwords have to be encrypted in Unicode. This adds another layer of complexity. My work around – just for when you are learning – is to weaken your domain security policy to allow: blank passwords, disable complex passwords, and disable password history. Later you can reset the policy to a more secure setting.
The goal on this page is to import users from a text file into active directory. Importing with the -i switch is the hardest command in LDIFDE; so my focus is on getting you started, and to keeping the commands as simple as possible.
Import Example 1
You have a bunch of users to import into active directory and all the usernames are in a text file, which you can easily convert to a .LDF file.
Important best practice –
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
The LDIFDE switches are case insensitive. So you can use either -F or -f
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
