Objective
In the previous article, "Proficient in Windows Server 2008 multiple password Policy ADSIEdit," I have introduced how to create, Manage password setting object PSO through ADSIEdit tools and Active Directory Users and Computer snap-in. The original reason things and need to pay attention to the place I will not repeat in this article and after the article. Please view the previous article if necessary. The next major focus is the hands-on part. Cut the crap, start! In order for everyo
properties that are exported (note that all of the following is on one line):
Csvde–f usersonly.csv–d ou=users,dc=contoso,dc=com–r "( (Objectcategory=person) (Objectclass=user))" –l DN, Objectclass,description
With the – I switch, you can import objects from the source CSV file into active Directory. However, there is a key limit to creating user objects using CSVDE: You cannot use CSVDE to set a user password. Therefore, you should avoid creating user objects using CSVDE.
specify the Lightweight Directory Access Protocol (LDAP) filter for search, the latter can limit the number of exported attributes (note that all of the following content is in one row ):csvde –f UsersOnly.csv –d ou=Users,dc=contoso,dc=com –r "((objectcategory=person)(objectclass=user))" –l DN,objectClass,descriptionThe-I switch enables you to import objects from the source CSV file to Active Directory. However, using csvde to create user objects has a key constraint: you cannot use csv
=" margin: 0px; border-top-width: 0px; border-right-width: 0px; border-bottom-width: 0px; background-image: none; padding-top: 0px; padding-right: 0px; padding-left: 0px; "alt =" image "src =" http://www.bkjia.com/uploads/allimg/131227/1H6421627-13.png "border =" 0 "/>
CSVDE exports user information, which is not demonstrated here. If you are interested, try it on your own. It is easier to export data using Powershell than CSVDE.
Use LDIFDE to import
Active| Object | Control method A
LDIFDE.exe, for bulk import and export of Active Directory objects. You can use LDIFDE to import new user records into a directory, or to export specific information for a specific user to a text file. The LDIFDE default is the output mode (read information from the directory). If you add the-i option, you can also write changes to the directory (see Microsoft Knowledge Bas
will always be such a problem! For this reason, although this article is very simple, I still want to write it out and share it with you. It is not only a practical solution, but also a careful attitude,
When we get this requirement, we may ask, where should I get these attributes? I cannot remember so many attribute values! In fact, we can also make changes. We can import them first, and then compare these attribute values based on the exported file. Let's take a look at the next process!
2. E
Method 1LDIFDE.exe is used to import and export Active Directory objects in batches. You can use LDIFDE to import new user records to a directory or export specific user information to a text file. By default, LDIFDE uses the output mode (reading information from the directory ). If the-I option is added, you can also write the changes to the Directory (see the Microsoft Knowledge Base article Q237677: Usin
export, and then based on the exported file to compare these attribute values can be completed, below let us look at the process.
Second, the environment description
1,DC (2003 system, installed with Office 2007)
2, the domain name is: tt.com
3, a OU:TT was established and a user was established under the TT OU: Alice
Third, use CSVDE export account
Microsoft defaults to providing two batch import export tools, namely CSVDE (CSV directory exchange) and LDIF
..\test
I found several articles about this issue,
The first article describes in detail how to generate a qualified unicodepwd (there are too many differences with the descriptions on msdn, and msdn is actually a fool ).
1.Http://technet.microsoft.com/en-us/magazine/ff848710.aspx
The second article describes in detail how to use the ldifde tool to import LDF files with unicodepwd.
2.Http://www.winserverkb.com/Uwe/Forum.aspx/windows-server-ad/20168/
password policies for administrators to increase the complexity of management, management is not very convenient, the so-called fish and bear paws can not be both. And I write this article's original intention is to help friends as soon as possible to become familiar with this function, fish and bear's paw, I want to both!
Deployment Attention Points
Multiple password policy deployments require the following:
A. All domain controllers must be Windows Server 2008;
B. The domain functional le
. for more information about the ldifde.exe tool, see using ldifde to import and export directory objects to Active Directory at http://r.office.microsoft.com/r/rlidOCS? Clid = 1033 p1 = kb237677.
To use the ldifde.exe to disable sip-enabled users, run the following command from the command prompt:
Ldifde-d "ou = users 'Ou, Dc = domain, Dc = dom"-l msrtcsip-userenabled: True-F sipenabledusers.txt
If s
Objective
In the last two articles, "Proficient in Windows Server 2008 Multi-meta password policy ADSIEdit" and "proficient in the Windows Server 2008 Multi-meta password Policy ldifde" I have introduced how to use ADSIEdit tools, Active Directory user and computer snap-in and LDIFDE command line tools Create, Manage password Settings object PSO. In this article, I will show you how to implement and manage
Objective
In the last few articles I have introduced how to create, manage password Set object PSO through ADSIEdit tools, Active Directory Users and Computer snap-in, ldifde command-line tools, Quest PowerShell. In this article, I will show you how to use a foreigner developed tool FGPP to implement and manage the multiple password strategy. I believe that after reading this article, we will love this direct and simple tool.
By convention, in order
Tools to use cwrsync:http://down.51cto.com/data/2103716BAT script used on Windows:@echo offset fdate=%date:~0,4%_%date:~5,2%_%date:~8,2%_%time:~0,2%_%time:~3,2% echo%fdate%ldifde-f%fdate%.ldfmove %fdate%.ldf d:\adbackup\addatad:\adbackup\command\cwrsync\rsync.exe--delete-az "/cygdrive/D/adbackup/addata" [ Email protected]::adbackup--password-file= "/cygdrive/d/adbackup/command/cwrsync/pass.txt"Where bat takes the time variable as the file name:"date:~
. Here we can get the complete HASH of the user. nltest/user: "TestAdmin" # lists the trust relationships established for your domain. Nltest/domain_trusts # the domain controller and its corresponding IP address in the list of Domain Name System (DNS) servers queried. This parameter also contacts to check the Connected Domain Controller www.2cto. comnltest/dsgetdc: abcDC: \ server-c95b23ad.abcAddress: \ 192.168.1.10Dom Guid: 6784b216-b3b5-4501-9f52-2f78bb702cacdom Name: abcForest Name: abcDc Si
context, whether it is an entire organization or some units in an organization.
2. Extensibility
The Active Directory is extensible, which means that administrators can add new classes of objects to the plan, and you can add new attributes to an existing object class. For example, you can add the recurring access permission attribute to the user object type, and then make the periodic access permissions for each user stored as user accounts.
You can add objects and properties to a directory
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.