Importing Data from AD

In Part 2 we  discussed how to export data from a working Active Directory installation. That was the easy part, now the real fun begins as we discuss how to import data to your Active Directory installation. It is strongly suggested to try this out on a test scenario, and try this out as much as need until you are certain that you know what the different switches do, as this will affect your installation of AD.

There are a few things that need to be done before you can import data to your Active Directory installation. First of all you have to create a CSV file with all the details of your users, which requires some basic knowledge of LDAP properties, manipulation of strings in Excel and some basic knowledge of scripting (which will later allow you to enable all the accounts you have created with a simple double click!).

First things first, what are LDAP Properties? Very simple, LDAP, or more fully Lightweight Directory Access Protocol, is an application protocol for querying and modifying directory services running over TCP/IP. A directory is a set of objects with attributes organized in a logical and hierarchical manner, or in plain English the properties of a user when you right click in Active Directory Users and Computers. There are countless options you can add, but for the sake of clarity we will stick to the 8 of the most basic ones you need to work with as described below:

Now that we know what the fields we need are, we can start creating a CSV file. The easiest way to do this is by using a spreadsheet application, in this case Microsoft Excel, which has a built-in function that will create a CSV file by separating the columns with commas. Let us start creating our template in Excel. We will just create the first row and fill in the rest by clicking and dragging

It is very important that before you start you make sure that you have created the Organizational unit you will add the users to, as CSVDE is unable to create Organizational Units. For this example the OU that has been created is named Test.

Below you have an example, simply fill in the first row in your sheet (the ones in bold). Next fill in only the givenName and SN columns.

Now the real fun starts, as the rest of the columns will be filled using string manipulation formulas that are built-in in excel. First of all we must know what naming convention we will adhere to; in this case it will be the first letter of the first name and the entire surname.

Let us start off easy, by concatenating the contents of two different cells so as to create the name and CN fields:

=B2&” “&C2       

This will concatenate cells B2 and C3 with a space in the middle.

The sAMAccountName for our user will be jdoe, and will be created as follows:

=LOWER(LEFT(B2,1) & (C2))        

This will take the first letter on the left of cell B2  ‘LEFT(B2,1)’ and concatenate to the whole contents  of cell C2 using the ampersand (&) and make sure it is all in lowercase (LOWER).

The process is similar for the userPrincipalName, but using the result of a previous formula:

=D2&”@testdom.com”                

This will concatenate the contents of cell D2 and append the name of the domain to it.

Finally the most complicated part, creating the Distinguished Name, which will use a combination of all the previous formulas to create a valid DN:

Now fill in the rest of the names and surnames and simply click and drag the other cells to completely fill the table for all your users.

To create a CSV file simply press F12 (Save As…) and select CSV (Comma Separated) as file type, click save and click ok on the prompt that pops up, which warns you that all formatting will be lost and that it won’t let you save multiple books.

The one CSVDE switch we will use to import is the -i switch. This will load the data from any CSV file that has been specified in the command, import the data into Active Directory, and you can also output a report log to a specified file.

The command to import is:

CSVDE -i -k -f test.csv

Let us break down the different switches:

-i                             The import switch which tells CSVDE that it has to import not the standard export.

-k                            Tells CSVDE to ignore all errors and continue importing data.

-f <filename>    Specifies the file name of the CSV file to be imported.

Now launch Active Directory Users and Computers so as to verify the users have been created.

Tip: Before running the CSVDE command, browse to the location of the CSV file so at to avoid typing long UPN path names which make for needless errors. eg. If the CSV file is stored in the Administrator’s documents make sure you have browsed to C:\Documents and Settings\Administrator\ before running the CSVDE command.

However, CSVDE has a limitation; it does not offer the functionality to enable the accounts that have just been created. Do not worry though, you will not have to enable the hundreds of accounts you have added one by one. There are various scripts available online that, with little editing, can help you enable all these accounts, along with the various flavours of the LDAP Property UserAccountControl, this gives you some flexibility on how and what exactly you can do. A good set of scripts and explanations of how they work and how to edit them can be found at the Computer Performance website.

In the first article of this series we discussed what CSVDE is and why you should use it. I will now discuss how to export data from Active Directory and how to import it in Microsoft Excel using CSVDE as well as touch on some basic data manipulation commands.

Exporting Data from AD

The easiest way to learn CSVDE is through a baptism by fire - try out the commands yourself. However, most of you will think “How can I experiment with AD without ruining my setup?” The easiest way to do this is by learning to use the export commands, which simply exports data and does not in any way modify the setup that there is in place.

When using the CSVDE tool, the command will always be formatted as follows:
CSVDE <-switch>  or  CSVDE <-switch> <switch requirement>

Example:
CSVDE –f users.csv runs the default CSVDE function, exporting all data to a file users.csv

CSVDE -f onlyusers.csv -r “(&(objectClass=user)(objectCategory=person))” exports only the specified details to users.csv.

The easiest way to view the data that has been exported by CSVDE is to locate the CSV file that was created, and open it using your favourite spreadsheet utility (all of them work, but here all examples will refer to Microsoft Excel). Note that CSVDE always exports to or imports from the current directory you are browsing in command prompt, thus if you are currently in c:\ it will save the files to c:\.

There a various switches that can be used and here’s a complete list with a full description. Here we will only discuss a few of the commands.
 
The most commonly used export switches:

• -f  Specifies file name to export to:
  CSVDE –f example.csv
  Note: Try not to use this switch alone, as it will export too much data for it to be comprehensible and thus useful to us.
• -d Specifies a particular Object to export, such as an OU:
  CSVDE -d “OU=<ouname>,DC=<domainname>,dc=com” -f example.csv
  
• -r Specifies which rows you want to export, such as users using the objectClass or object category:
   CSVDE –f example.csv –r objectClass=Person
  You can even combine multiple objects in your filter:
  CSVDE -f userdata2.csv -r “(&(objectCategory=person)(objectclass=user))”
  
• -L Specifies which LDAP fields, or columns, will be exported, separated by a comma:
   CSVDE –f example.csv –l “DN, objectClass, givenName, sn, name”
  IMPORTANT!
  Do not mix –l with –i as they are used for two completely different things, thus since CSVDE is not case sensitive it would be wise to use –L to avoid confusion.
• -m Used to exclude Active Directory properties such as the ObjectGUID, objectSID, pwdLastSet  and samAccountType attributes.
• -n Used to exclude binary values from the exported CSV file.

Thus, for example let us imagine you are an administrator, and you have been contacted by HR to produce a list of all the users in the Sales OU, with their Full Name, Logon and full distinguished name and without other junk such as binary data and so on. The command used to produce such a CSV file would be:

CSVDE -d “OU=Test,dc=bernard8,dc=com” -m -n -f testou.csv -r objectclass=user -l “name, userPrincipalName,dn”

In this case the first line of the CSV file would read:

DN,name,userPrincipalName

“CN=John Smith,OU=Test,DC=test,DC=com”,John Smith,jsmith@test.com

For some reason CSVDE sorts the LDAP fields in its own way no matter how you enter the data.

Now you should be confident enough with CSVDE to be ready to try the import switch, which we will discuss in part 3 of this article.

What is CSVDE and why should I use it?

Comma Separated Value Data Exchange (CSVDE) actually comes built-in Windows 2003 Server installations (normally in %windir%/system32 directory). A comma-separated value (CSV) file is usually a plain text file, with the data contained in rows and columns separated by commas (,). This makes it relatively easy to decipher and most common spreadsheet applications (such as Microsoft Excel or OpenOffice Calc) can open it without making any modifications to the file and display it organized neatly in rows and columns.

CSVDE can be used both to export data about a current Active Directory Configuration, the easiest thing that will in no way effect your working configuration, and to import data into a new installation of Active Directory, which is not recommended unless you are doing so on a test setup or is closely familiar with the intricacies of CSVDE. When importing data using CSVDE, it will directly affect your system since data is being added and manipulated. Ideally this should be first tried out in a test scenario which does not affect a live installation.

In the next article we will discuss how to export data from Active Directory and how to import it in Microsoft Excel using CSVDE as well as touch on some basic data manipulation commands. Finally in the last part, we will also discuss how to create a template using an Excel worksheet, create a CSV file and how to import data into Active Directory.