Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've read a little around the subject of the userPassword attribute in AD and how it can be set as a write-alias for unicodePwd.

We're considering moving from OpenLDAP to AD. I can extract the userPassword from OpenLDAP as a salted hashed string {ssha}blabla... My question is, can I then set this password "as is" in the userPassword attribute of AD with write-alias activated, and have that then update the unicodePwd attribute automatically? Or does the userPassword field expect passwords in clear?

Basically is there any way I can transfer the user passwords from OpenLDAP to AD?

share|improve this question
up vote 1 down vote accepted

I don't believe it can be done, due to the fact that the hash is not reversible and is salted.

Usually, even between AD domains, tools that do this intercept the password change request at the domain controller level and execute the change on both domains at the same time, it is not done through a synchronization of the actual LDAP attribute data.

I'd suggest investigating alternatives such as a web interface where people could authenticate against the old LDAP that would grab the password and set it in AD, or something similar.

share|improve this answer
Thanks. Shame there's no way to do this. Can't see why they don't allow it because it's not exactly a security issue. – ianbeks Mar 30 '11 at 15:40

You cannot inject the hash from OpenLDAP to AD and expect it to work.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.