Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have two lists of users (about 1000 each) that we need to add to groups in Active Directory (Windows Server list will be in one group, one in the other). All the users currently exist in the directory, but we just need to assign them properly. Is there an easy way to do this without scripting? If not, can it be scripted with Ruby, Perl or Python?


share|improve this question

You can use ldifde to import users from an ldif file or csvde to import from a csv file.

The articles are for 2000, but they still apply to the 2003 versions.

Sorry about that, misread the question. What you really want then is the dsmod or the more direct dsadd commands. You can redirect a file or do a simple batch script like:

for /f %%i in (%1) do dsadd group <group_dn> -members %%i

Then call that as add.bat <file_of_users>

share|improve this answer
Thanks!...but I'm not importing users, as much as trying to add existing users to a security group... – JB. Feb 5 '10 at 1:31
up vote 0 down vote accepted

I ended up scripting it in ruby. I'm not a big fan of Windows batch scripting and this way I could do it from my Linux box (my primary desktop). Hope it helps others:

require 'ldap'

conn ='ad-server-host-name', 389)
conn.bind('user', 'password')

puts "Connected? #{conn.bound?}"

group_dn = "CN=blah, OU=blah, OU=blah, OU=blah, dc=company, dc=com"

mod = [LDAP.mod(LDAP::LDAP_MOD_DELETE, 'member',     ["CN=test,OU=Test,OU=blah,DC=blah,DC=blah"])]

  conn.modify(dn, mod)
rescue LDAP::ResultError
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.