TTS,
I was under the impression that we took care of this already. I may be
mistaken.
If you want to import all of the user account objects from one DC ( of one
domain ) to another DC ( of a different domain ) then you can follow the
example that I gave you in our last exchange. You need to first export all
of the user information from the first domain to a .ldf file and then import
that information ( after making the necessary changes ) to the second
domain.
Here is an example:
C:\>ldifde -f users.ldf -s yourserver.yourfirstdomain.com -t 389 -d
"DC=yourfirstdomain,DC=com" -p subtree -r
"(&(objectCategory=person)(objectClass=user))" -l
"DN,objectClass,userAccountControl,sAMAccountName,displayName,givenName,sn,s
treetAddress,l,st,postalCode,c,co,countryCode,
department,company,physicalDeliveryOfficeName,telephoneNumber"
This will give you the majority of the common fields/attributes in the user
account objects from 'yourfirstdomain.com' in a nice .ldf file called
users.ldf. Please note that there could be more attributes that you might
need to add ( such as homePath, etc. ). You can then change the appropriate
information to reflect 'yourseconddomain.com' via the find and replace tool
in Notepad. Then simply import that file on your second DC (
C:\>ldifde -i -f users.ldf ) and there you have it.....
For the groups you can use the syntax that I gave you in our first exchange
as well. Just in case you do not have it here it is ( probably the same ):
C:\> ldifde -f groups.ldf -s yourserver.yourfirstdomain.com -t 389 -d
"DC=yourfirstdomain,DC=com" -p subtree -r "(objectClass=group)" -l
"DN,member,info,description,groupType,instanceType,objectClass,name,sAMAccou
ntName"
This gives you the nice file called groups.ldf which will contain all of
your groups. Please note that there will be some domain specific groups
that you might not want to include. I might suggest that you use the -m
switch. All you would then need to do is to import the groups.ldf file in
your new domain ( C:\>ldifde -i -f groups.ldf ).
Not sure that I would do this for the computer account objects or for the
lost and found. Do not believe that it works this way. For the system
state you need to simply install WIN2000 Server and then run dcpromo to
create yourseconddomain.com. You can not - to my knowledge - use ldifde to
do this. Another alternative is to do a restore from backup....but that is
a whole other situation.
As to the e-mail addresses I think that I would first install Exchange 2000
in 'yourseconddomain.com', import the users.ldf file and then the groups.ldf
file and finally manually create the 'mailbox' for each user. You can do
this en masse via the ADUC. This might be easier for you.
I do not know what else to tell you. I gave you the three links to the RFC
and the MSKB link on how to use ldifde. I know that this can be a bit
frustrating for people when they are first beginning with ldifde as it has a
rather unforgiving syntax.
My suggestion would be to play with it in a test lab and become more
familiar with it. This is how I became familiar with it.
BTW - I would be remiss if I did not mention that you could use the -m
switch when exporting all of the user information. The -m switch removes
some of the domain specific information. However, with using the -l switch
with the attributes that I have suggested and then doing the one time (
hopefully ) find and replace from within Notepad you should have a clean
slate.
HTH,
Cary
PS. Please note that there are also other tools to do this. One of the
limitations of ldifde is that you can not really do anything about the
passwords. You would simply have a blank password for each user account
object initially. This may or may not be acceptable. You could look at
addusers.exe ( which allows you to include passwords ) and then use ADModify
to add the majority of other fields. However, the drawback there is that
you have to pretty much create the original file from scratch. ldifde is
much easier in this regard.
TTS said:
I want to import all the objects in a DC to another DC. Does it give the
same output as that of system state restore? Can I do it with LDIFDE?
In fact I tried it, am successfull in exporting all the objects in the AD.
But when trying to import getting strange errors and no hint from Microsoft
sites.
Any advice will be highly appreciated. I want to import all the computers,
Lost and found, groups, email address associated with the user accounts,
groups.
