We help IT Professionals succeed at work.

using ldif to compare users in both parent and child domain to resolve user based barracuda issue

and_the_beat_goes_on
and_the_beat_goes_on asked
on
Scenario: While my question basically pertains to ldif the reason for it is that we are trying to implement user based quarantine for the barracuda anti-spam firewall. We have a parent and a child domain. We can point the barracuda to either a DC in the parent domain or a DC in the child domain and it resolves the ldap query for users in each respective domain but cannot point to one domain and resolve users in both the parent and child. The barracuda does not allow you to point to more than one domain controller for ldap and we cannot get it work even when we point to the GC server. Barracuda tech support has recommended that we run ldif on DC's in both domains to compare users in both domains to see if for some reason AD is not updating/replicating correctly between the parent/child domain.

I am a ldifde newbie. I know I need to use the export command, but I want be sure that I am only making a COPY of users into a txt file and that I will not be literally exporting users out of my domain controllers. I am probably reading too much into this command, but I want to be absolutely sure before I do it. I was planning on using the following command because the barracuda uses SAMAccountName as the LDAP UID.

ldifde -f domainusers.txt -s xyzdc1 -d "dc=Mydomain,dc=local" -p subtree -r "(&(objectCategory=person)(objectClass=User)(givenname=*))" -l "cn=givenName,objectclass,samAccountName

We have Win Server 2003, Any help or guidance would be appreciated. Thanks,



Comment
Watch Question

Commented:
http://www.petri.co.il/list_all_users_and_groups_in_domain.htm

http://technet.microsoft.com/en-us/library/bb727091.aspx#ECAA

I don't think,it removes the users from AD,if you doubt take a system state backup.

Commented:
LDIFDE can be used to modify accounts.  Be careful of the -i switch.  Syntax is very specific too for importing, and it isn't the default export format.  Exporting a list of attributes gives you a list to work with for information purposes, or for modifying for an import.

You can also use csvde for grabbing a list of accounts and attributes.  This will put it into an excel compatible format.  Almost the same format, but than you can use excel functions to compare lists.

-l "cn=givenName,objectclass,samAccountName

-l switch is just a list of attributes you want exported, otherwise you get almost everything.
"cn= is not valid
It would be "cn,givenName,objectclass,samAccountName"

http://support.microsoft.com/kb/237677

You can always test it by modifying your -d value to go farther down active directory to a specific OU.