Usage: admodcmd [-dn BaseDN] [-p pagesize] [-s] [-server servername] [-f LDAPFilter] [modification]

Transcription

1 Active Directory Bulk Modify Tool Command Line Version 2.1 ADModCmd runs an LDAP query against the specified AD container. The modifications are then performed against the results of the query. Usage: admodcmd [-dn BaseDN] [-p pagesize] [-s] [-server servername] [-f LDAPFilter] [modification] Required -dn BaseDN Modification Base DN to begin the LDAP query. Modification to perform. See below for details. Optional -p pagesize LDAP Page size to use for query. -s Denotes a subtree search. (If -s is not specified, search defaults to onelevel). -server servername Denotes the server to make the changes to (If -server is not specified, changes are made locally if on a DC. If on a member, DNS is used to find a DC). -f LDAPFilter A Valid LDAP filter to use when enumerating objects (If -f is not specified, (objectclass=user) is the default filter). Modification Switches NOTE: Using the word "null" (without quotes) as an attribute value will clear the attribute. Terminal Server Attributes Windows 2003 or later is required to modify Terminal Server attributes. -tsprofilepath [ProfilePath] -tshomefolderpath [FolderPath] Sets the users Terminal Server Profile path to the specified value. Sets the users Terminal Server folder path to the specified value. -tsnetworkfolderpath [drive] [FolderPath] Sets the users Terminal Server home folder path to a network share. drive should be the drive that FolderPath will be mapped to. -tsenable -tsdisable -enableremote -required interact -disableremote -tsstartingprogram [program] -tsstartin [location] -maxdisconnectedsession [minutes] -maxconnectiontime [minutes] Enables the user for Terminal Server. Disables the user from using Terminal Server. Enables Remote Control for the user. The -required and -interact switches are optional. If required is used, "Require Users Permission" will be checked. If -interact is specified, then "Interact With The Session" will be checked. Disables Remote Control for the user. Sets the program to start when the user logs on to Terminal Server. Sets the location for the users startup program to start in. Sets the maximum disconnected session time for the user in minutes. Setting to 0 minutes indicates an unlimited time. Sets the maximum connection time for the user in

2 minutes. Setting to 0 indicates an unlimited time. -maxidletime [minutes] -sessionlimitaction [disconnect end] -allowreconnect [any originating] -tsconnectclientdrives [yes no] -tsconnectclientprinters [yes no] -tsdefaulttomainprinter [yes no] Sets the maximum idle time for the user in minutes. Setting to 0 indicates an unlimited time. Specifies the action to take when a sessions limit has been reached. Specify either disconnect (disconnect the session) or end (end the session). Specifies whether or not to allow a reconnect from anywhere (any) or just the originating client (originating). Specifies whether or not to connect client drives upon logon to a Terminal Server session. Specifies whether or not to connect client printers upon logon to a Terminal Server session. Specifies whether or not to default to the main client printer. Exchange Related Attributes -killmail -includeinrecipientpolicy -excludefromrecipientpolicy -hidefromaddresslists -showinaddresslists -includeinmailboxmanager -excludefrommailboxmanager -enablehttp -disablehttp -enablepop3 -disablepop3 -enableimap4 -disableimap4 Removes Exchange Attributes. Checks "Automatically Update Addresses Based on Recipient Policy" Check box. Unchecks "Automatically Update Addresses Based on Recipient Policy" Check box. Hides the user from all Address Lists. Shows the user in address lists. Includes the user in mailbox manager policies. Excludes the user from mailbox manager policies. Enables HTTP for the user. Disables HTTP for the user. Enables POP3 for the user. Disables POP3 for the user. Enables IMAP4 for the user. Disables IMAP4 for the user. The three MAPI settings below require that the users mailbox is homed on an Exchange 2003 SP2 or later server. -enablemapi -disablemapi -enablecachedmapi Enables MAPI access for the user. Disables MAPI access for the user. Enables MAPI access for users in cached mode only. -addsmtp [address] -setasprimary updat Adds an SMTP address to the user. Address will need to be in the form of variable@domain.com (Information on variable usage can be found below under "Variables"). Specify the optional setasprimary switch to set the address as primary (default is secondary). Use the updat switch to also set the address on the ADU&C General tab. -removeaddress [address] Removes any address that matches the specified filter. Wild cards are allowed. Examples would be: smtp:*@domain.com smtp:*@doma??.com Normal * and? wildcard matching rules apply. Please note that this can be used to remove any match found in the users Proxy Addresses list, not

3 just SMTP addresses. Matches are case-insensitive. Mailbox Rights -setmailboxrights Sets msexchmailboxsecuritydescriptor. KB fixsendas -removefixsendas -grantselfaea -removeaeafromself -grantselffullandread -removefullandread -dumpmailboxrights -importmailboxrights [overwrite append] -addtomailboxrights DOMAIN\USER Grants Send-As rights to users with Full Mailbox Access and Read. KB Removes Send-As rights from users Full Mailbox Access and Read. Undo for KB Grants Associated External Account privileges to SELF. KB Removes Associated External Account from SELF. Undo for KB Grants Full Mailbox Access and Read to SELF. KB Removes Full Mailbox Access and Read from SELF. Undo for KB Dumps all permissions in Mailbox Rights to a file called mbxrights.xml. Imports mailbox rights from the mbxrights.xml created by the -dumpmailboxrights switch. When using this switch, the -dn switch is not required. Overwrite will remove all non-inherited ACE's before importing, append will not. This switch only imports non-inherited mailbox rights. Adds an account to mailbox rights with the specified permissions masks. The optional -deny switch specifies a deny entry, default is an allow entry. Valid Access Masks: ACE_MB_FULL_ACCESS ACE_MB_DELETE_MB_STORAGE ACE_MB_READ_PERMISSIONS ACE_MB_CHANGE_PERMISSION ACE_MB_TAKE_OWNERSHIP -removefrommailboxrights DOMAIN\USER ACCESS_MASK -deny (optional) Removes the specified mask from DOMAIN\USER in mailbox rights. The -deny switch specifies a deny entry, default is an allow entry. Valid Access Masks: ACE_MB_FULL_ACCESS ACE_MB_DELETE_MB_STORAGE ACE_MB_READ_PERMISSIONS ACE_MB_CHANGE_PERMISSION ACE_MB_TAKE_OWNERSHIP ALL The ALL Mask will remove all permissions for the specified user. User Account Settings -enableaccount -disableaccount -passwordnotrequired [yes no] -passwordneverexpires [yes no] -mustchangepassword [yes no] -cannotchangepassword [yes no] Enables the user account. Disables the user account. Specifies whether to set the password not required option. Specifies whether to check or uncheck the "Password Never Expires" box. Specifies whether to check or uncheck the "User Must Change Password at Next Logon" box. Specifies whether to check or uncheck the "User Cannot Change Password" box.

4 -usereversibleencryption [yes no] Specifies whether to check or uncheck the "Store Password Using Reversible Encryption" box. -smartcardrequired [yes no] -cannotbedelegated [yes no] -usedesencryption [yes no] -donotrequirekerberospreauth [yes no] -addtogroup [DNOfGroup] -removefromgroup [DNOfGroup] -allowinheritable [yes no] -modrdn [NewRDN] Specifies whether to check or uncheck the "Smart Card is Required for Interactive Logon" box. Specifies whether to check or uncheck the "Account is Sensitive and Cannot be Delegated" box. Specifies whether to check or uncheck the "Use DES Encryption Types for This Account" box. Specifies whether to check or uncheck the "Do Not Require Kerberos Preauthentication" box. Adds the user to the specified group. Removes the user from the specified group. Specifies whether to check or uncheck the "Allow inheritable permissions to propagate to this object" box. Changes the users Relative Distinguished Name (CN). Variable usage is required. To change an RDN to LastName, FirstName use the following syntax: -modrdn "%'sn'%, %'givenname'%" Custom Attributes The custom switch allows you to name the attribute you wish to modify. This operation is only supported against attributes of the following type: Boolean Case Insensitive String Distinguished Name DN Binary IA5 String Integer Numerical String Unicode String Syntax: [-custom attributename attributevalue -multi -remove] attributename attributevalue -multi (optional) -remove (optional) The name of the attribute you wish to modify. The value to give the attribute. Specifies a multi-valued append. If the attribute being modified is multi-valued this switch needs to be used. Otherwise, the value will be overwritten, not appended. Specifies a multi-valued remove. If the attribute being modified is multi-valued and -remove is used, then only the specified value will get removed. Example for setting description attribute: -custom description "IT Department" Variables Variable usage is allowed when building attributes. Variables can be based off of almost any current Active Directory attribute, as long as it has a value. Variables are seperated from literal values using the % sign. Variables must also be enclosed in a single tick ('). This example shows how to set homedirectory to the path c:\test\username,

5 where username is the users samaccountname: -custom homedirectory c:\test\%'samaccountname'% It is also possible to pull only a specified number of characters from the attribute as well. Just specify the number of characters you want to use after the %, and before the "'". The following example shows how to add an SMTP address of FirstInitial.LastName@domain.com: -addsmtp %1'givenName'%.%'sn'%@domain.com If a % or ' is needed as a literal value, simply use the forward slash (/) as an escape character: Example: This is a percent sign: /% The above line will end up being: This is a percent sign: % There may be times where you need a literal forward slash before the percentage or single tick characters, usually when the forward slash needs to be followed by a variable. The syntax for this is //% or //' An example would be adding an MS Mail address: ms:po/server//%'mailnickname' Undo Mode Changes made with ADModify can be undone, as long as the xml log file that logged the changes still exists. These log files are typically located in the same folder as the admodify executable. Syntax: [-undo logfilename -server servername] -undo logfilename -server servername (optional) Specifes the log file that contains the changes to be undone. Specifies the DC to write the changes to. If left blank changes are written locally if the local machine is a DC. If not, DNS is used to find one. For information on users that were skipped during an undo process, refer to the undo.log file. For more information on sample usage, please refer to the ADModify help.