Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to change the logonHours attribute in Active Directory over LDAP, eg. using ldapmodify. The attribute is of type byte string.

Is this possible?

share|improve this question
    
Are you asking if ldapmodify can modify the attribute? If you have ldapmodify, you can easily try and modify an account. –  David Yu Mar 15 '12 at 16:43
add comment

1 Answer

up vote 3 down vote accepted

Use base64 encoding of the binary string in your LDAP change. The :: specifies that the value is base64 encoded.

So, here's the base64 encoded version of 21 bytes of 11111111, to allow login always:

logonHours:: ////////////////////////////

And here's 00000000, for never:

logonHours:: AAAAAAAAAAAAAAAAAAAAAAAAAAAA

And, say, 9 to 5 on Monday through Friday:

logonHours:: AAAAAAD/AAD/AAD/AAD/AAD/AAAA
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.