Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We want to migrate our user-accounts from OpenLDAP to Active-Directory without changing the passwords and such. The users shouldn't notice the difference against which server they're authenticating then.

How-to-create-active-directory-user-account-with-powershell is a very interesting approach, but since the passwords are stored encrypted it is not working for us.

What are possible solutions / setup for our task?

OpenLDAP Version: 2.1 on SuSE, Windows Server 2008

share|improve this question
up vote 3 down vote accepted

Unlikely you'll be able to get the passwords out of OpenLDAP unless it operates in a manner different than the typical directory.

What some customers do in this scenario is stand up a middle layer for authentication that first checks the user's password against the source and then writes it to AD if it is valid prior to authenticating them. If you do this with a few key services, over a short period of time you'll capture most of the passwords.

share|improve this answer
That's a very cool idea. Problem: create such a middle-layer. Perhaps I've just to created an internal phishing-site and ask each user to enter his credentials. – ppuschmann Sep 16 '09 at 14:52

For the import, if you can dump your data in CSV format, CSVDE works well for bulk-importing into AD. We recently migrated a couple of hundred users from eDirectory to AD with this, and it went very well. I can't answer your password question, as when we did it we just set the "must change password on next logon" bit and got the users to do it themselves.

share|improve this answer
Thanks for the hint with CSVDE. I'll have a look. "on next logon" will be a bit tricky, because Active-Directory will first replace the Authentication for IMAP, Apache2 and so on. – ppuschmann Sep 7 '09 at 11:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.