Export Active Directory objects with ldifde before performing changes with ADSI Edit

ADSI Edit can be very useful and powerful toll in right hands, but it can also cause lots of problems if used incorrectly.

Before making any changes using ADSI Edit it is always recommended to perform a full Active Directory backup (using ntbackup or a third party backup software).

It can also be a good idea to export Active Directory objects you intend to change using ldifde tool. In this case, if something goes wrong you can simply import affected object without doing full Active Directory recovery.

For example flowing command will export all objects in yourdomain.com > Configuration > Services > Microsoft Exchange to a file C:\export.ldf
ldifde  -f C:\export.ldf -d "CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=yourdomain,DC=com" -p subtree

Some system attributes cannot be imported using ldifde, therefore it may be useful to make another export omitting these attributes:
ldifde  -f C:\export_no_syst.ldf -d "CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=yourdomain,DC=com" -p subtree -o "uSNCreated,uSNChanged,objectguid,whencreated,whenchanged"

More information about ldifde can be found here.

No thoughts on “Export Active Directory objects with ldifde before performing changes with ADSI Edit”

Leave your comment

In reply to Some User