Export Active Directory objects with ldifde before performing changes with ADSI Edit

ADSI Edit can be very useful and powerful toll in right hands, but it can also cause lots of problems if used incorrectly.

Before making any changes using ADSI Edit it is always recommended to perform a full Active Directory backup (using ntbackup or a third party backup software).

It can also be a good idea to export Active Directory objects you intend to change using ldifde tool. In this case, if something goes wrong you can simply import affected object without doing full Active Directory recovery.

For example flowing command will export all objects in yourdomain.com > Configuration > Services > Microsoft Exchange to a file C:\export.ldf
ldifde  -f C:\export.ldf -d "CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=yourdomain,DC=com" -p subtree

Some system attributes cannot be imported using ldifde, therefore it may be useful to make another export omitting these attributes:
ldifde  -f C:\export_no_syst.ldf -d "CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=yourdomain,DC=com" -p subtree -o "uSNCreated,uSNChanged,objectguid,whencreated,whenchanged"

More information about ldifde can be found here.

Comments  

Shaun
# Shaun 2013-11-08 03:49
That's a great tip - got myself into hot water after installing and removing Exchange 2013 - without disabling the 'hybrid config'. I went back to Exchange 2010, and now I cant manage/delete the hybrid ADSI objects because I need EMC v15.0.0.0 and above. Doesnt seem to be much in the way of help out there either so Im having to manually edit ADSI - this backup command you have done will come in handy. Thanks very much.

Newsletter

Subscribe to receive occasional updates on new posts.
Your email will not be used for any other purpose and you can unsubscribe at any time.
Please wait