LDIFDE - Export

[James Kenneth Williams]

I am working to be able to export Active Directory
objects, including users and groups, and be able to
maintain the rights & permissions during an import.

I've run the following exports, thus far:
1). ldifde -f exportou.ldf -s wan-dev-srv -
d "dc=mydomain,dc=com" -p subtree -
r "objectclass=organizationalunit)" -l "cn,objectclass,ou"

2).ldifde -f groups1.ldf -s wan-dev-srv -t 389 -
d "dc=mydomain,dc=com" -p subtree -
r "(objectClass=group)" -
l "DN,member,info,description,groupType,instanceType,object
Class,name,sAMAccountName"

3). ldifde -f users.ldf -s wan-dev-srv -t 389 -
d "DC=mydomain,DC=com" -p subtree -r "(&
(objectCategory=person)(objectClass=user))" -
l "DN,objectClass,userAccountControl,sAMAccountName,display
Name,givenName,sn,streetAddress,l,st,postCode,c,co,countCod
e,department,company,physicalDeliveryOfficeName,telephoneNu
mber"

The rights & permissions are not carried over to the new
machine. What am I missing.

Any help that you can provide will be greatly appreciated.

Regards, James

 

[Cary Shultz [A.D. MVP]]

James,

You will not really be able to maintain permissions when using ldifde. I am
not sure what you mean by that, though. Are you talking about permissions
on folders and files? If that is the case then consider using xcopy.

HTH,

Cary

 

[Cary Shultz [A.D. MVP]]

James,

Also noticed that a few little odds and ends were missing. I am sure that
these are simply typos ( but the will cause a problem if not corrected ).

In your OU entry you left off the '(' after the -r filter....it should look
like -r "(objectClass=organizationalUnit)". You also left off the -t 389
switch that you included in the other two but that is no biggie as both
the -s and -t switches are optional. I just like to use them to be
completely thorough.

In your Users entry you left off a 'y' on 'countryCode' after the -l switch.
You have 'countCode'.

Anyway, just a few little tidbits. And I must say that the group and user
entries look very familiar! ;-)

HTH,

Cary