Home / server / Questions / 181211
Accepted
FrinkTheBrave
Asked: 2010-09-15 15:30:20 +0800 CST

How to Export and Import AD Users, Groups and Group Membership?

  • 772

Hallo, I want to copy my Active Directory Users, Groups and Group Memberships from one DC to another using csvde, where the machines are identical except for the only the name of the Domain and Machine. Note that each server is a DC and itself is the only member of the domain. The command I am using for export is:

csvde -f C:\exportAD.csv -m -n -o "primaryGroupID,lockoutTime" -j C:\Logs\

I then edit the csv file, deleting a few lines which will not import, and changing the Domain and Machine name, then import it on the second machine using:

csvde -i -f C:\exportAD.csv -k -j C:\Logs\

However, this does not the group memberships present in the original.

Any ideas?

-Frink

active-directory

2 Answers

  1. The reason is probably that the groups have different SIDs in each domain. You do realise that you can not export passwords using CSVDE?

    Have you considered the Active Directory Migration Toolkit?

    • 1
  2. Best Answer

    In the end I used:

    csvde -f C:\Rename\export_AD.csv -m -n -o “primaryGroupID,lockoutTime” -j C:\Rename\Logs
Where:
  -f filename to export to
  -m do not export SAM values, e.g. objectSID
  -n do not export binary values
  -o exclude named columns
  -j folder to log to (produces csv.log, plus csv.err if any errors occured)

    I then edited the export_AD.csv file as follows:

    Delete the lines beginning:
o   “CN=Builtin …       (1 expected)
o   “CN=Infrastructure… (1 expected)
Delete all lines containing:
o   ,samServer,     (1 expected)
o   ,rIDSet,            (1 expected)
o   ,secret,            (4 expected)
o   ,rIDManager,        (1 expected)
Remove any ‘box’ (ASCII 13) characters in the text:
o   Unfortunately these cannot be searched for in Notepad
o   There may be one in the commas at the end of each of the last 50 lines in the file
Replace all instances of ‘PCOld’ with ‘PCNew’
o   Where PCOld is part of the machine name and domainname

    Then import:

    csvde -i -f C:\Rename\export_AD.csv -k -j C:\Rename\Logs
o   -i import
o   -f filename to export to
o   -k ignore non-serious errors (e.g. object, attribute or value already exists)
o   -j folder to log to (produces csv.log, plus csv.err if any errors occured)
    • 1