ldifde.exe i f groups.ldf in Visual C#.NET

Making ANSI/AIM Code 39 in Visual C#.NET ldifde.exe i f groups.ldf

After this command is issued, two new global groups named Marketing and Finance would be added to the Users container of the contoso.com domain. To add two members to a group using Ldifde, the LDIF file would be:

dn: CN=Finance,CN=Users,DC=Contoso,DC=Com changetype: modify add: member member: CN=Dan Holme,OU=employees,dc=contoso,dc=com member: CN=Scott Bishop,OU=employees,dc=contoso,dc=com -

The changetype is set to modify and then the change operation is specified: add objects to the member attribute. Each new member is then listed on a separate line that begins with the attribute name, member. The change operation is terminated with a

4-19

line containing a single dash. Changing the third line to the following would remove the two specified members from the group:

Exam Tip Both Csvde and Ldifde provide import and export capabilities, allowing large numbers of security principals (including users or groups) to be created at once with the least possible administrative effort. However, the Ldifde command and its file structure are nowhere near as intuitive for administrators as the comma-delimited file supported by Csvde. For the 70-290 certification examination, you should understand that both commands are able to import and export objects using their respective file formats. Only Ldifde is capable of modifying existing objects or removing objects.

The Dsadd command, introduced in 3, is used to add objects to Active Directory. To add a group, use the syntax

The GroupDN parameter is one or more distinguished names for the new user objects. If a DN includes a space, surround the entire DN with quotation marks. The GroupDN parameter can be entered one of the following ways:

By piping a list of DNs from another command such as dsquery. By typing each DN on the command line, separated by spaces. By leaving the DN parameter empty, at which point you can type the DNs, one at a time, at the keyboard console of the command prompt. Press ENTER after each DN. Press CTRL+Z and ENTER after the last DN.

The Dsadd Group command can take the following optional parameters after the DN parameter:

-secgrp {yes | no} determines whether the group is a security group (yes) or a distribution group (no). The default value is yes. -scope {l | g | u} determines whether the group is a domain local (l), global (g, the default), or universal (u). -samid SAMName desc Description -memberof GroupDN... specifies groups to which to add the new group -members MemberDN... specifies members to add to the group

4-20

4

As discussed in 3, you can add -s, -u, and -p parameters to specify the domain controller against which Dsadd will run, and the user name and password the credentials that will be used to execute the command.

{-s Server | -d Domain} -u UserName -p {Password | *}

For example, to create a new global security group named Marketing in the Employees OU of the Contoso.com domain, the command would be:

The Dsget command, introduced in 3, returns specified attributes from one or more objects. The Dsget command has a particularly useful role with groups: it can return the list of members of a group. For example, the following command returns a list of DNs of each member of the Sales group:

Dsquery returns a list of objects in Active Directory based on properties specified as search criteria. It is the most common way to produce a list of DNs to pipe to another directory service command. Dsget, however, is the only directory service command that produces a list of DNs of members of a group.

Global groups can nest into other global groups, universal groups, or domain local groups. Universal groups can be members of other universal groups or domain local groups. Domain local groups can belong to other domain local groups.

This flexibility brings with it the potential for complexity, and without the right tools, it would be difficult to know exactly which groups a user belongs to, whether directly or indirectly. Fortunately, the Dsget command solves the problem. From a command prompt, type:

dsget user UserDN -memberof [- expand]