As an administrator of an Active Directory (AD) domain, at some point you're going to want to perform some typical AD management tasks for multiple objects in one operation. You can automate many tasks in Windows 2000 if you're skilled in Windows Script Host (WSH) and Active Directory Service Interfaces (ADSI) scripting technologies, but bulk operations of common administrative tasks can be difficult without this knowledge. The Ldifde and Csvde tools provide limited support, but creating the required input files (i.e., LDAP Data Interchange Format—LDIF—and comma-separated value—CSV—files) can be tedious. Therefore, most people don't find these tools complete or easy to work with. Consequently, executing AD management operations for multiple objects under Win2K can be frustrating. Fortunately, Microsoft addressed this problem by providing a set of six directory service command-line tools in Windows Server 2003. Let's look at how to use these tools in some real-world situations that you might encounter.
6 Tools
The directory service tools are included with Windows 2003 or can be installed with the Windows 2003 Admin Pack. You can also install and run them on computers that are running Windows XP Service Pack 1 (SP1), but Microsoft doesn't recommend that you install the tools on Win2K computers. The tools can target Windows 2003 domain controllers (DCs) and Win2K DCs that have SP3 or later installed.
You use the six directory service tools to perform typical AD operations from the command line:
- Dsadd adds a computer, contact, group, organizational unit (OU), quota, or user to a directory.
- Dsget displays selected attributes of a computer, contact, group, OU, partition, quota, server, site, subnet, or user in a directory.
- Dsmod modifies an existing computer, contact, group, OU, partition, quota, server, or user in a directory.
- Dsmove moves any object (except a partition or quota) from its current location in the directory to a new location in the same domain and renames the object.
- Dsquery uses specified search criteria to find a list of computers, contacts, groups, OUs, partitions, quotas, servers, sites, subnets, or users in a directory.
This tool also uses the * parameter to perform Lightweight Directory Access Protocol (LDAP) queries.
- Dsrm deletes from a directory any object that you specify on the command line.
In the balance of this article, I show you how to use the directory service tools from the command line. Of course, the challenge is to type these commands without any errors, but I alleviate this problem by providing CommandList.txt, which contains all the commands I use. So instead of typing the commands, you can download CommandList from the Windows Scripting Solutions Web site, cut the desired command from the file, and paste it at the Windows command prompt. (Go to http://www.windowsitpro.com/windowsscripting, enter 43753 in the InstantDoc ID text box, then click the 43753.zip hotlink.)
Creating Objects with Dsadd
Let's start by creating some users. Suppose we have a flat file containing the names of the users we want to create. For each user, the file lists the first name, a space, the last name, and a carriage return, as in the MyUsers file that Figure 2 shows. Using the Windows command shell's For statement in combination with Dsadd, we can create this set of users with one command:
For /f "tokens=1,2 delims= "
%i in (MyUsers.Txt) do
Dsadd user "cn=%j %i,ou=MyOU,
DC=LissWare,DC=Net" -samid %i.%j
(Although the command has been split across multiple lines to fit the print newsletter format, you must type it on one line.)
The For /f statement uses a loop to parse the file content. Within the loop, the statement looks for the default space delimiter in each line, placing the first name (before the space) in the first token (%i) and the last name (after the space) in the second token (%j).
The Dsadd statement then uses the output of the For /f loop to create the users whose names are in the file. The command interpreter replaces %i with the first name and %j with the last name. As you can see, the first parameter specified for Dsadd is user, which specifies that we're creating a user object rather than a computer object, an OU object, or some other object type. The second parameter is the user's distinguished name (DN), which consists of an OU and a domain. If the OU doesn't exist, you can create it with a statement similar to
dsadd ou "OU=MyOU,DC=LissWare,
DC=Net"
The last parameter, -samid, defines the sAMAccountName attribute and corresponds to the legacy logon name.
You can specify many more parameters on the command line, such as the first name (givenName attribute) and last name (sn attribute). Although you can set these properties at creation time, we'll perform this task in the next section of the article to give ourselves the opportunity to play with the Dsmod and Dsquery tools.
If you don't have much experience with command-shell commands, I recommend that you look at the online documentation provided about Windows 2003 installations. To access the documentation, open a command prompt and type
hh.exe %systemroot%\help
ntcmds.chm
Modifying Objects with Dsmod
Now that we've created a few users, let's set some properties for them. To update the givenName attribute by using the -fn (first name) switch and the sn attribute by using the -ln (last name) switch, we use a command similar to the one we used to create the users:
For /f "tokens=1,2 delims= "
%i in (MyUsers.Txt) do
Dsmod user "cn=%j %i,
ou=MyOU,DC=LissWare,DC=Net"
-fn "%i" -ln "%j"