LDIFDE

[DDB]

I'm learning how to import users to our AD.
When successful the users ar edisabled. I tried importing
USerAccountControl 512 (&others) and get errors. How do I
import an enabled user? 2. Can I import their passwords?
Thanks, DDB

 

[Simon Geary]

The password attribute is write-only so cannot be exported. That's why your
users are disabled by default when you import them, they have a blank
password.
You can't specify a new password when you import a user but you can change
it afterwards. So this has to be done in a two stage process: Stage 1,
import the users, stage 2, change the password and enable the accounts.
This kb shows you how to change passwords with ldifde.
http://support.microsoft.com/?id=263991

 

[Scott Lowe]

I'm learning how to import users to our AD.
When successful the users ar edisabled. I tried importing
USerAccountControl 512 (&others) and get errors. How do I import an
enabled user? 2. Can I import their passwords?
Thanks, DDB

I'm working on a project where we are creating large numbers of new
accounts via LDIFDE. What I've done to remedy the issue of accounts
coming in disabled is to use the dsmod utility from the Windows Server
2003 Resource Kit to make mass changes (i.e., enable all the accounts,
set a generic first time password, force password change at first
logon, etc.).

You can use LDIFDE to run an export (after importing the users), then
run the export file through a couple of grep filters to narrow it down
to only the dn: line. Then pipe that line to dsmod user and make all
your changes in an automated fashion.

Hope this helps.