Microsoft’s Exchange Server comes with an impressive number of default management commands, but these are not always the best for every job. This blog will teach you how to use CSVDE and LDIFDE from the command line so that you can manage your Microsoft Active Directory from any shell on your system or workstation.
The “ldap command line” is a tool that allows users to manage Active Directory from the command line. The tool comes with CSVDE and LDIFDE which are two separate tools.
For many enterprises, Active Directory (AD) is a critical IT resource. Managing AD from the command line makes sense, particularly when dealing with large amounts of data or scripting. Although PowerShell is an excellent tool for administering AD in this manner, what if you don’t want to, or can’t use it?
With Specops’ 100% free Password Auditor Pro, you can find, report, and prevent unsafe Active Directory account passwords in your environment. Download it right now!
csvde and ldifde are two useful command-line programs that don’t receive as much attention as PowerShell. These command-line tools enable you to import, export, or alter AD data.
These two utilities make data migration across AD domains and data import from non-AD LDAP directory services more easier. They do this by enabling you to transport AD data using normal plain text files (CSV and LDIF).
You will discover the potential of each of these instruments in this post!
What do CSVDE and LDIFDE stand for?
CSVDE (Comma Separated Value Directory Exchange) and LDAP Data Interchange Format Data Exchange (LDIFDE) are two programs for importing and exporting Active Directory (AD) data to and from text files. CSVDE is a program that imports and exports data from CSV files. LDAP Data Interchange Format (LDIF) files are imported and exported using Ldifde.
Parameters in Common
This post will teach you how to use these tools in a variety of ways. Each of these operations will be carried out using one or more parameters. I
If you work with both csvde and ldifde, you’ll see that their parameters are quite similar. Each instrument serves the same objective, but in a different manner.
A table outlining each parameter and its function can be seen below.
| Parameter | Category | Purpose |
|---|---|---|
| -i | General | Import Mode should be enabled. (Export is the default.) |
| filename -f | General | Filename for input or output |
| servername -s | General | The server to connect to (by default, the domain’s DC). |
| -c ToDN FromDN | General | ToDN should be used instead of FromDN. When using ldifde, the attribute value will be searched up in rootDSE and used to replace #attributeName if either FromDN or ToDN ends with #attributeName. In DNs, see the section Expansion of macroeconomics. |
| -j path | General | Log files directory path |
| -t port | General | The port number to use while connecting to AD. 389 is the default value. For SSL, use port 636. |
| -u | General | Use the Unicode encoding. |
| -h | General | Enable layer signature and encryption using the Simple Authentication and Security Layer (SASL). |
| -? | General | Help. Unlike other command line tools, where -? and -h both call command help, the -? and -h options have separate meanings. |
| -d RootDN | Export | The LDAP search’s root (Default to Naming Context) – also known as the SearchRoot. For further information, see PowerShell Active Directory and LDAP Filters. |
| -r Filter | Export | (ObjectClass=*) is the default LDAP search filter.) For further information, see PowerShell Active Directory and LDAP Filters. |
| SearchScope -p | Export | (Base/OneLevel/Subtree) Search Scope For further information, see PowerShell Active Directory and LDAP Filters. |
| -l list | Export | A list of characteristics to check for in an LDAP search (comma separated). |
| -o list | Export | List of characteristics to exclude from export (comma separated). |
| -g | Export | Paged Search is disabled. |
| -m | Export | On export, enable the SAM logic. |
| -n | Export | Binary values should not be exported. |
| -k | Import | The import will proceed despite warnings such as Constraint Violation and Object Already Exists. |
| -a [Password | *] UserDN | Credentials | Simple authentication is recommended. |
| -b Domain UserName [Password | *] | Credentials | Binding to the Security Support Provider Interface (SSPI). The logged-in user is used as the default authentication mechanism. |
Translating a Distinguished Name
You may export data from one domain and import it into another using ldifde. But what about domain-specific references, like as the distinguished name (DN) of an AD object? Fortunately, these technologies include a notion called DN translation that allows them to manage such situations.
DN translation allows you to “inject” a particular domain DN during import and export operations using the -c parameter. When the -c parameter is used in the form -c ToDN FromDN , any occurrences of FromDN are swapped to ToDN.
The differentiated name DC=lab,DC=local is substituted by DC=corp,DC=local in the following example.
> csvde -f export.csv -c DC=lab,DC=local DC=corp,DC=local
Expansion of macroeconomics
LDIFDE also supports the concept of Expansion of macroeconomics. Expansion of macroeconomics is the ability to use a shortened name or macro to refer to some of the well-known naming contexts in LDAP. Ldifde supports the following macros:
| Macro | Context |
|---|---|
| #defaultNamingContext | Naming Context by Default |
| #rootDomainNamingContext | The Forest’s Root Domain Naming Context |
| #schemaNamingContext | Context of Schema Naming |
| #configurationNamingContext | Naming Context for Configuration |
Perhaps you have Fiona Cortez as an employee who you’d want to move from the corp.local domain to the lab.local domain. The following command is used to export Fiona’s user object to an LDIF file called fiona.ldf:
> ldifde -f fiona.ldif -r “samAccountName=Fiona.Cortez” Exporting directory to file fiona.ldif Searching for entries… Writing out entries. 1 entries exported
Fiona’s AD object record, which can be found in the fiona.ldf file, looks like this:
CN=Cortez Fiona,OU=All User Accounts,DC=corp,DC=local change CN=Cortez Fiona,OU=All User Accounts,DC=corp,DC add account type Expires: 9223372036854775807 Fiona Cortez, cn CN=Cortez Fiona,OU=All User Accounts,DC=corp,DC=local dSCorePropagation CN=Cortez Fiona,OU=All User Accounts,DC=corp,DC=local Data: 16010101000000.0Z given Fiona’s instanceType is 4 e-mail address: [email protected] objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=corp,DC=local objectName: Cortez Fiona top object class Person object class organizationalPerson object class sAMAccount user class Fiona is her name. Cortez userAccountControl: 546 sn: Cortez
When using ldifde -i to import this record into the lab.local domain, the following error occurs:
> ldifde -i -f fiona.ldf Importing directory from file “fiona.ldf” Loading entries. Add error on entry starting on line 1: Referral The server side error is: 0x202b A referral was returned from the server. The extended server error is: 0000202B: RefErr: DSID-031007F9, data 0, 1 access points ref 1: ‘corp.local’ 0 entries modified successfully. An error has occurred in the program
To get Fiona’s user object to import into the lab.local domain, change each occurrence of corp.local to lab.local for each distinguished names in the LDIF file. You could do this manually, but Expansion of macroeconomics can do this for you using the #defaultNamingContext macro. The #defaultNamingContext macro represents the Naming Context by Default of the AD domain.
The Naming Context by Default for an AD domain is the part of an object’s DN. The DN is made up of domain components or DCs (not to be confused with domain controllers). For example, in the distinguished name CN=Cortez Fiona,OU=All User Accounts,DC=corp,DC=local, the domain components are DC=corp,DC=local. The Naming Context by Default for the corp.local domain is DC=corp,DC=local.
Fiona’s record is successfully imported using the following command. #defaultNamingContext is cn=lab,cn=local in this example. cn=corp,cn=local is replaced by cn=lab,cn=local in all differentiated names.
> ldifde -i -f fiona.ldf -c “cn=corp,dc=local” “#defaultNamingContext”
Using Expansion of macroeconomics with the -c parameter is only supported by ldifde and LDIF files. The same approach cannot be used with csvde and CSV files.
Parameters for LDIF
Despite the fact that both programs contain identical settings, ldifde differs somewhat by having a few that csvde does not. These options conduct actions that are exclusive to the ldifde tool.
| Parameter | Category | Purpose |
|---|---|---|
| timeout -w | General | If the server takes longer than the provided number of seconds to reply to an action (default = no timeout set), the program will be terminated. |
| -x | Export | Deleted items are included (tombstones) |
| -1 | Export | Only keep the most essential records. PropertyMetadata |
| -y | Import | For greater efficiency, the import will utilize lazy commit (enabled by default) |
| -e | Import | Lazy commit will not be used in this import. |
| threads -q | Import | The chosen number of threads will be used during the import (default is 1) |
| -z | Import | Regardless of mistakes, keep importing. |
| -x | Import | Support for tombstone reanimation is enabled (passes deleted objects control with ldap modify requests) |
Working with the LDIFDE and CSVDE databases
The rest of this essay will teach you how to utilize these helpful tools firsthand.
Prerequisites
If you want to follow along, make sure you meet the following requirements first:
- Windows 7 or above is required.
- When reading CSV files created by csvde, you’ll need Microsoft Excel or another spreadsheet tool installed on your computer.
- Remote Server Management Software (RSAT)
Exporting Active Directory Objects from a Current Domain
It’s possible that you’ll need to export data from AD. The -f argument, which enables you to specify a file, makes this simple.
The command below exports everything in the current AD domain to the -f parameter-specified file.
> csvde -f export.csv > ldifde -f export.ldf
In a production setting, this might take a long time and have an effect on AD performance.
When examined in Excel, a typical CSV export file for an entire domain might look like this.
Excel view of a domain export CSV file
Adding Active Directory Objects to the Current Domain
You may use the -f argument on either tool if you already have a CSV file with AD objects. Perhaps you’re now using the import to import AD data. previously exported csv file Use the -i argument to do this.
You may, for example, import everything that the import.csv file contains inbuilt using the -i and -f arguments.
> csvde -i -f import.csv > ldifde -i -f import.ldf
Understanding CSVDE’s Data Translation
When you export data from AD, Csvde modifies some of the data. This is done so that it may be saved in plain text format, such as CSV. If you’re editing data in Microsoft Excel or importing it into a system that isn’t Active Directory, this behavior may take you off guard.
Take a look at the pc.csv CSV export file from the lab.local domain. For the user Paul Cox, csvde created this file. Paul is identified by his samAccountName when the -r argument is used to define an LDAP filter.
> csvde -r “samAccountName=Paul.Cox” -f pc.csv Exporting directory to file pc.csv Searching for entries… Writing out entries . Export Completed. Post-processing in progress… 1 entries exported
By opening pc.csv in Excel or another spreadsheet tool, you may inspect its structure. It will resemble the following:
pc.csv
The memberOf column demonstrates how csvde handles multi-valued AD characteristics. As you can see below, csvde uses a semicolon (“;”) to separate values. In the picture below, the semicolon is emphasized. It’s difficult to find amid all the commas.
As exported to Excel, the memberOf attribute
The objectGUID column in pc.csv demonstrates how csvde handles AD characteristics that aren’t directly represented as text or integers – the software outputs a value prefixed by “X” and surrounded in single quotes.
As exported to Excel, the objectGUID attribute
The value is presented in this fashion because csvde has modified the value of objectGUID to make it storable in a plain-text format like CSV. The objectGUID value will be transformed before being transmitted to AD when the file is imported by csvde. There seems to be no documentation on how these settings are altered or reversed.
The table below shows which AD attributes are encoded and which objects in AD have that property.
| Property | Classes of Objects |
|---|---|
| auditingPolicy | domainDNS |
| dNSProperty | dnsZone |
| dnsRecord | dnsNode |
| dSASignature | domainDNS |
| ipsecData | ipsecNegotiationPolicy ipsecFilter ipsecNFAipsecISAKMP Policy ipsecPolicy |
| jpegPhoto | user |
| logonHours | user |
| msDFSR-ContentSetGuid | msDFSR-Subscription |
| msDFSR-ReplicationGroupGuid | msDFSR-Subscription |
| msDFSR-ReplicationGroupGuid | msDFSR-Subscriber |
| msDS-GenerationId | computer |
| objectGUID | There is one object for every AD object. GUID |
| objectSid | builtinDomain computer domainDNS user group foreignSecurityPrincipal |
| operatingSystem | computer |
| replUpToDateVector | domainDNS |
| repsFrom | domainDNS |
| samDomainUpdates | samServer |
User Accounts Export
Perhaps you simply need to export user accounts. Let’s say you’re not presently signed into a computer with access to query AD to make things more interesting. Alternate credentials must be specified.
The -m argument in the example below refers to data that the application deems sensitive, such as objectGUID and objectSid. These characteristics aren’t exported. The LDAP filter to use is specified by the -r argument.
In Excel, a typical CSV export file with user objects might look like this:
CSV file exported by the user and examined in Excel
All Objects in an Organizational Unit are exported (OU)
You may export just those things in a specified OU if you don’t want to export all objects in AD.
All objects from an OU, including the OU object itself and any sub-OUs, are exported using the following command. If we don’t provide an LDAP filter with -r, the default is “objectClass=*” (all objects). The -d argument specifies where in the directory tree the search should begin. It is set to the OU that we are interested in in this situation, as illustrated below.
> csvde -f ouexport.csv -d “OU=All User Accounts,DC=lab,DC=local” > ldifde -f ouexport.ldf -d “OU=All User Accounts,DC=lab,DC=local”
When you export an AD object to a file using csvde or ldifde, the objects in the file are listed in a certain order. This is the sequence in which the data will be imported into another domain or LDAP server.
The OUs are created before the user objects inside the OUs, for example. After all of the users have been established, related characteristics such as manager are added. The following is an example LDIF file (snipped for brevity) that shows the sequence in which objects are created and modified:
dn: CN=Smith Brian,OU=All User Accounts,DC=lab,DC=local changetype: add distinguishedName: CN=Smith Brian,OU=All User Accounts,DC=lab,DC=local —-SNIP—-
Exporting Specific User Account Attributes
There will be times when you don’t need to use csvde or ldifde to export all of the information about a person. Data for the construction of physical phonebooks or the export of user information for import into a non-Active Directory system are two examples. –
The -l argument is used in this example to enable the export of certain object characteristics. Each user’s Given Name, Surname, Phone Number, and Email Address are included in the export file. The -l argument may be used to provide these properties.
> csvde -f export.csv -r “objectCategory=user” -l givenName,sn,telephoneNumber,mail > ldifde -f export.ldf -r “objectCategory=user” -l givenName,sn,telephoneNumber,mail
Changing Objects in Active Directory
While both csvde and ldifde are intended to input and export large amounts of data, only ldifde can modify AD objects. Microsoft, for example, employs LDIF files to expand the AD schema. These activities are supported by the LDIF file format.
The LDIF changetype has no counterpart in the CSV files used by csvde. Only AD objects may be imported or exported using Csvde.
Keep in mind that some of the properties you export from AD can’t be restored. These properties are either produced by the system or are only accessible by the system. Some examples are:
lastLogoff lastLogon badPwdCount badPasswordTime primaryGroupID objectGUID objectSid logonCount pwdLastSet sAMAccountType
Changing the kind
The changetype lin is a crucial piece of data in an LDIF record that enables it to be utilized for a variety of purposes. As seen in the example below, the changetype line in an LDIF file determines what will happen to an item in AD given by the DN line above the changetype.
changetype: add CN=Cox Paul,OU=All User Accounts,DC=lab,DC=local
There are many types of changetypes, which are listed in the table below:
| Modify the Type | Options |
|---|---|
| add | |
| delete | |
| moddn/modrdn | deleteoldrdn 0 | 1 newsuperior newrdn |
| modify | remove and replace |
Adding a new changetype
A new AD object is created when you use the Add changetype. For single-valued characteristics, values are provided one per line; for multi-valued attributes, values are supplied on several lines. An example of an add record is shown below (snipped for brevity).
This is an add record, as the second line (changetype: add) indicates.
changetype: add CN=Cox Paul,OU=All User Accounts,DC=lab,DC=local objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user cn: Cox Paul sn: Cox description: IT Manager givenName: Paul distinguishedName: CN=Cox Paul,OU=All User Accounts,DC=lab,DC=local —SNIP—
Changing the changetype to Delete
The delete changetype is basic in structure and removes an item from AD. The only necessary attribute in the LDIF file is the DN, which specifies the DN of the AD object to be destroyed. This is followed by a changetype: delete line, as illustrated in the example below.
changetype: delete dn: OU=Legacy OU,DC=lab,DC=local
ldifde may be used to remove a wide range of things. If you use ldifde incorrectly, you might potentially damage your AD installation. Be cautious!
Changing the changetype to Modify
Add, remove, and replace operations are executed to attributes of the specified AD object using the modify changetype. An example LDIF file is provided below to demonstrate how this may be utilized in reality. Angelique’s phone number is replaced, her office address is added, and her fax number is removed in this example.
dn: Cortez Angelique,OU=All User Accounts,DC=lab,DC=local,CN=Cortez Angelique changetype: alter # No one uses faxes, do they? replace: telephonenumber telephonenumber: +44 1234 567890 – add: physicaldeliveryofficename physicaldeliveryofficename: Corner Office Delete the following: facsimiletelephonenumber
ModDN/ModRDN changetype use
To rename or relocate an AD item in the directory tree, use the moddn or modrdn changetype.
To determine where the item will be relocated, use the newsuperior value. The object’s name is determined by the newrdn value, which is required. The deleteoldrdn value specifies whether the old rdn value should be maintained or replaced by the newrdn value. If the item should be renamed in situ, leave out the newsuperior value. The child items of the moving object are likewise moved.
Below is a sample LDIF file for moving the Professional Services OU out from beneath the Services OU.
dn: Professional Services, Services, Lab, Local modrdn changetype OU=Professional Services newrdn: 1 deleteoldrdn DC=lab,DC=local, newsuperior
Changing an Attribute’s Value
Let’s look at how to use ldifde to change the value of an existing AD attribute. –
The description property for a user is modified in this example. To begin, the user’s description property is exported to an LDIF file, which is then modified. The -l option specifies which characteristics should be included in the LDIF file. The -r option specifies an LDAP filter for determining which objects ldifde returns.
> ldifde -r “samAccountName=Angelique.Cortez” -f ac.ldf -l description Exporting directory to file ac.ldf Searching for entries… Writing out entries. 1 entries exported The command has completed successfully
The file ac.ldf that results looks like this:
changetype: add description: Compliance Guardian CN=Cortez Angelique,OU=All User Accounts,DC=lab,DC=local
The changetype is set to modify, and a replace line indicating the attribute to be edited is inserted to make this a modify record. The description line has been updated to reflect the new value. Finally, to signify the conclusion of the alteration, a new line containing just “-” is inserted. When you save the file, it should appear like this:
changetype: alter replace: CN=Cortez Angelique,OU=All User Accounts,DC=lab,DC=local General Manager – (description)
As seen below, running ldifde with the -i argument imports the modifications into AD.
> ldifde -i -f ac.ldf Importing directory from file “ac.ldf” Loading entries.. 1 entry modified successfully. The command has completed successfully
The change may be seen by repeating the export step above and looking at ac.ldf.
changetype: add description: General Manager CN=Cortez Angelique,OU=All User Accounts,DC=lab,DC=local
Members of an AD Group Can Be Modified
Let’s look at how to use ldifde to change the membership of an AD group. –
The membership of the group Professional Service Department is altered in this example.
Use the -m and -n options to export the group to an LDIF file named psd.ldf, for example. The data produced by these switches is stripped of security sensitive and binary properties. The command to do so is listed below.
> ldifde -r “cn=Professional Services Department” -f psd.ldf -m -n
The psd.ldf file is displayed below (snipped for brevity).
changetype: add cn: Professional Services Department distinguishedName: CN=Professional Services Department,OU=All Groups,DC=lab,DC=local changetype: add cn: Professional Services Department distinguishedName: CN=Professional Services Department,OU=All Groups,DC=carisbrookelabs,D —-SNIP—- member: CN=Cox Paul,OU=All User Accounts,DC=lab,DC=local changetype: modify add: member member: CN=Professional Services Department,OU=All Groups,DC=lab,DC=local – member: CN=Diaz Kristin,OU=Professional Services,OU=All User Accounts,DC=lab,DC=local changetype: modify add: member member: CN=Diaz Kristin,OU=Professional Services,OU=All User Accounts,DC=lab,DC=local –
The sequence of entries in the psd.ldf file indicates that the group is established first, followed by the addition of members. Instead of a samAccountName, SID, or commonname, the member property has a DN. This is how AD stores the characteristic.
Let’s pretend that Angelique Cortez has to be added to the Professional Services group for this example. CN=Cortez Angelique,OU=All User Accounts,DC=lab,DC=local is her distinguishing name. The LDIF format required to add a user to a group is shown in the export file psd.ldf. This is made up of a modify changetype, an add line, and a member line.
Remember to conclude the modify record by adding the “-” on its own line.
The new LDIF file, saved as group.ldf, looks like this, following the example of the export file:
changetype: alter add: CN=Professional Services Department,OU=All Groups,DC=lab,DC=local CN=Cortez Angelique,OU=All User Accounts,DC=lab,DC=local – member
The -i argument is used to import the LDIF file, as seen below.
Angelique will have been successfully added to the group if there are no issues.
Changing a User’s Password
Using an LDIF file to reset a password involves updating the user’s unicodePwd property. The new password must be base64 encoded and encased in double quotes (NewPassword must be given as “NewPassword”). The new password must also adhere to the user’s password restrictions, such as length and complexity. The password change will fail if these prerequisites are not met.
The user’s password is changed in the example below, and the value of the userAccountControl attribute is adjusted to 512. This action activates the account.
Password updates in LDIF files must be imported via a secure connection. Use the -t argument to use port 636, or the -h parameter to use Simple Authentication and Security Layer (SASL). Password changes made via insecure connections will fail.
changetype: alter CN=Cortez Angelique,OU=All User Accounts,DC=lab,DC=local IgBGAGwAeQBpAG4AZwBJAHMATQB5AFQAaABpAG4AZwAxACIA replace: unicodePwd unicodePwd::IgBGAGwAeQBpAG4AZwBJAHMATQB5AF – userAccountControl userAccountControl: 512 should be replaced. –
Adding a Photograph to a User Profile
By entering a file name in the LDIF file, the ldifde program enables you to set the [jpegphoto](https://docs.microsoft.com/en-us/windows/win32/adschema/a-jpegphoto) property for a user. The provided file is imported into the jpegphoto property in the example below. Note that the file path uses forward slashes and follows the file URI scheme.
dn: CN=Cortez Angelique,OU=All User Accounts,DC=lab,DC=local changetype: modify replace: jpegphoto jpegphoto: < file:///photos/angeliquephoto.jpg –
Before it is loaded, the file’s content is not verified for invalid or harmful material in any manner. Be cautious!
Troubleshooting
Despite the fact that the csvde and ldifde programs might save you a lot of time, things don’t always work as planned. This section contains several recommendations to assist you in dealing with different situations you may encounter.
Creating CSVDE and LDIFDE Logs
To produce logs of the import or export, use the -j argument. This argument should link to the location of the log files. The logs are simple text files with names like csv.err and csv.log for csvde and ldif.err and ldif.log for ldifde. The *.log files include activity logs, but the *.err files contain just errors.
A unsuccessful csvde import, for example, produces a csv.log file that looks like this:
Getting connected to “lab.local” Using simple bind to log in as “[email protected]” Directory “dc.csv” is being imported. CN=Cortez Angelique,OU=All User Accounts,DC=lab,DC=local Attribute loading2 1) distinguishedName: CN=Cortez Angelique,OU=All User Accounts,DC=lab,DC=local Attribute 0) description: Team Leader 2) userEntry already exists, therefore entry is skipped. 0 entries were successfully updated. The command was successfully executed.
For the same problem, the.err file looks like this:
Attribute 1) distinguishedName: CN=Cortez Angelique,OU=All User Accounts,DC=lab,DC=local Attribute 0) description: Team Leader User 2: Entry already exists; entry skipped.
If the -l or -o options don’t provide the anticipated results, double-check the spelling of any attribute names you want to include or exclude. Always double-check the spelling of server, file, and other names. Any errors here will result in import or export difficulties.
“The input file has a syntactic mistake.”
This general error indicates where the import is failing in the LDIF or CSV file:
Line 3 was a failure. The final token begins with the letter ‘n.’
“A gadget connected to the system isn’t working.”
When using ldifde to update a user’s password, this error occurs. There are two probable reasons for this.
Add an error to the first line of the entry: Unwilling to Participate The server error code is 0x1f. A gadget connected to the system isn’t working. The following is the extended server error: 0000001F: DSID-031A1254, issue 5003 (WILL NOT PERFORM), data 0; SvcErr: DSID-031A1254, problem 5003 (WILL NOT_
Cause 1: Incorrectly formatted password
Make sure the unicodePwd property is replaced with a base64 value. Before base64 encoding, the password must be a Unicode string surrounded in double quotes. You may base64 encode the password using a variety of methods, including internet services and command line programs. Here’s how to use PowerShell to base64 encode a password.
PS51> [Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes(‘”PassWordInQuotes1″‘)) IgBQAGEAcwBzAFcAbwByAGQASQBuAFEAdQBvAHQAZQBzADEAIgA=
Attempting to establish a password over an insecure connection is the second cause.
Another possible reason is attempting to change a user’s password without using a secure connection. –
To encrypt your connection to AD, use the -t 636 (use port 636) or -h (use SASL) arguments. Password updates will fail if this is not done.
“On Line 2 Errors”
csvde may sometimes generate error messages that begin with “errors on line 2.” This generally indicates a problem with the file format.
This error might indicate that in a CSV file, for example, wrong attribute names were used for column headers. The first data line following the headers in a CSV file is line 2. This error indicates that the import procedure failed from the beginning.
Take a look at the following sample from a CSV file to see what I mean. The first and last names columns are labeled firstName and lastName, respectively (instead of givenName and sn). The import will fail due to a Error: no such attribute on line 2.
Error: no such attribute
“Access to the property is not authorized because the Security Accounts Manager (SAM) owns the attribute.”
Several AD characteristics are not scriptable. They are handled by AD, and attempting to change one of them results in this error.
Line 2 has an error: Unwilling To Perform. “Access to the property is not authorized because the attribute is held by the Security Accounts Manager (SAM),” says the server error.
When exporting, use the -m argument to remove the limited characteristics from the output file. In addition, attributes that are hyperlinks to other attributes (such memberOf and manager) cannot be set directly. The following is a list of properties that you can’t set using csvde and ldifde:
when objectGUID objectSid Developed when uSN was changed. uSN was created. Changed lastLogoff lastLogon badpasswordTime lastLogon pwdLastSet dSCorePropagation timestamp lockout data badPwdCount logonCount Instance of time objectCategory sAMAccountType accountExpires primaryGroupID type memberOf manager
“The account supplied already exists.”
Existing AD objects cannot be updated or recreated using CSVDE. You’ll receive the following error notice if you attempt.
Line 2 has an error: Already Exists “The provided account already exists,” says the server error.
“Unlawful modification operation.” Some aspects of the change are prohibited.”
Attempting to remove an OU while its isCriticalSystemObject attribute is set to True, for example, may be prevented by AD constraints. Regrettably, the error notice does not specify which modification is prohibited.
The server error code is 0x2077. Operation of illegal modification. Aspects of the alteration are prohibited. 00002077: SvcErr: DSID-031B0F19, issue 5003 (WILL NOT PERFORM), data 0 is the extended server fault.
“The password could not be changed.” The new password value given does not fulfill the domain’s length, complexity, or history criteria.”
Here, the error message reveals the tale. Make sure that any password you’re using fulfills the AD domain’s criteria. For additional information on how these standards are developed, see the Password Policy page on Microsoft Docs.
Add an error to the first line of the entry: Unwilling to Participate The server error code is 0x52d. The password could not be changed. The new password value given does not fulfill the domain’s length, complexity, or history criteria. 0000052D: SvcErr: DSID-031A1254, issue 5003 (WILL NOT PERFORM), data 0 is the extended server fault.
“A parameter is missing”
The message’s enlarged error section contains a hint. In this scenario, the deleteoldrdn value in the LDIF file must be set to 1.
Add an error to the first line of the entry: Unwilling to Participate The server error code is 0x57. This parameter is wrong. The whole server error code is 00000057: LdapErr: DSID-0C090E43, data 0, v3839, comment: Old RDN must be erased
“The operation failed because the object’s parent was either uninstantiated or removed.”
This error indicates that the new location for a move operation is not available. The LDIF file’s newsuperior value is most likely incorrect.
Add an error to the first line of the entry: Other The server error code is 0x2089 Because the object’s parent is either uninstantiated or removed, the operation could not be completed. The whole server error code is 00002089: DSID-031B0DCE, data 2, issue 5012 (DIR ERROR)
“The server has returned a referral.”
The DNs of the items you’re attempting to import don’t match the domain you’re trying to import them into. To remedy this, use the macro feature or manually update the differentiated names to the right value before importing.
Add an error to the first line of the entry: Referral The server error code is 0x202b. The server responded with a referral. The whole server error code is 0000202B: DSID-03100835, data 0, 1 access points RefErr:
“Cannot find directory object”
This issue happens when you include a DN in your import file that does not exist. Is the thing in question no longer there? Check the distinguishing name for any mistakes.
Add an error to the first line of the entry: No Such Object 0x208d Directory object not found is the server-side error. The whole server error code is 0000208D: Problem 2001 (NO OBJECT), data 0, NameErr: DSID-03100241, best match of: ‘DC=lab,DC=local’
“An attribute that is essential is missing.”
Certain necessary properties must be present before AD objects can be created. One of the properties is missing, according to this error. Unfortunately, it does not specify which one. Take a look at the AD schema documentation to see which attributes are required for each object type.
A free read-only Password Auditor scan from Specops will check your Active Directory for 750M+ known leaked credentials.
Line 2 has an error: Constraint Violation. “A necessary attribute is missing,” says the server error.
“The import file could not be read.”
This error often indicates that the file is missing from the supplied location. Make sure the file path and spelling are correct.
Unable to read the import file <filename>
“The output file could not be opened”
This error might indicate that another process is using the file. Make sure the export file isn’t already open in another application.
Opening the output file failed.
“The link could not be made.” 8224 is the error code.
Check that the server, domain, or forest name is valid, and that the domain controller has network connection.
“Simple bind returned ‘Invalid Credentials’ or SSPI “bind with given creds” returned ‘Invalid Credentials’”
This error indicates that your AD authentication user name or password is wrong.
“No Active Directory Domain Controller Available” is an invalid parameter.
This error indicates that the machine on which csvde or ldifde is executing is unable to recognize an AD domain. Use the -s argument to indicate a server (you’ll probably need to use the -a or -b parameters to supply credentials as well).
