LDIFDE (LDAP Data Interchange Format Directory Exchange)

LDIFDE (LDAP Data Interchange Format Directory Exchange)

A previous article described about CSVDE usage. This article will walk you through another tool LDIFDE (LDAP Data Interchange Format Directory Exchange), it is also a command prompt-based tool similar to CSVDE to export information from Active Directory.

LDIFDE and CSVDE both are the tools that can be used to export data from Active Directory, and for creating AD objects by using data presented in LDIF or CSV format. The exported data can be filtered
based on its location of the object, OU membership and object class, such as user, group or computer. While exporting exporting information (and exporting is what this article is about), you can also select what attributes should be exported, along with many other options.

Syntax

ldifde [-i] [-f FileName] [-s ServerName] [-c String1 String2] [-v] [-j Path] [-t PortNumber] [-d BaseDN] [-r LDAPFilter] [-p Scope] [-l LDAPAttributeList] [-o LDAPAttributeList] [-g] [-m] [-n] [-k] [-a UserDistinguishedName Password] [-b UserName Domain Password] [-?]

Here we have some scenarios to use LDIFDE or CSVDE:

1. Adding a bulk lot of new users to Active Directory, complete with passwords.
2. Modifying existing users or groups in Active Directory.
3. Exporting Active Directory information.  We may want to modify attributes then import again.
4. Changing schema information, for example adding email attributes.

Import With LDIFDE

When an administrator wants to import entries from a file into the active directory, [-i] in above syntax indicates the import switch, without this switch LDIFDE will just export information. To master importing user accounts, you must understand the LDAP attributes.  You can simply import the data with a command like this:

ldifde -i -f accounts.ldf -s server01

Export With LDIFDE

If you need to export OUs, users, and groups from an Domain, you can use below LDIFDE export command in the domain:

ldifde -f exportOU.ldf -s MyDC1 -d "dc=personal,dc=com" -p subtree -r "(objectCategory=organizationalUnit)" -l "cn,objectclass,ou"

If you need to export OUs, users, and groups from an entire forest, you may either run the above LDIFDE export commands against each domain in the forest, or alternatively, run the query once against the global catalog (GC). To do this, ensure that the domain controller that is specified by the -s switch is a GC, and additionally, specify the GC port using the -t switch. The GC port number is 3268.

ldifde -f exportusers.ldf -s MYDC1 -t 3268 -d "dc=personal,dc=com" -p subtree -r "(&(objectCategory=person)(objectClass=User)(givenname=*))" -l "cn,givenName,objectclass,sAMAccountName"

For More information on LDIFDE usage refer to MS KB 237677