We have two lists of users (about 1000 each) that we need to add to groups in Active Directory (Windows Server 2003...one list will be in one group, one in the other). All the users currently exist in the directory, but we just need to assign them properly. Is there an easy way to do this without scripting? If not, can it be scripted with Ruby, Perl or Python?


2 Answers 2


You can use ldifde to import users from an ldif file or csvde to import from a csv file.

The articles are for 2000, but they still apply to the 2003 versions.

Sorry about that, misread the question. What you really want then is the dsmod or the more direct dsadd commands. You can redirect a file or do a simple batch script like:

for /f %%i in (%1) do dsadd group <group_dn> -members %%i

Then call that as add.bat <file_of_users>

  • Thanks!...but I'm not importing users, as much as trying to add existing users to a security group...
    – JB.
    Feb 5, 2010 at 1:31

I ended up scripting it in ruby. I'm not a big fan of Windows batch scripting and this way I could do it from my Linux box (my primary desktop). Hope it helps others:

require 'ldap'

conn = LDAP::Conn.new('ad-server-host-name', 389)
conn.bind('user', 'password')

puts "Connected? #{conn.bound?}"

group_dn = "CN=blah, OU=blah, OU=blah, OU=blah, dc=company, dc=com"

mod = [LDAP.mod(LDAP::LDAP_MOD_DELETE, 'member',     ["CN=test,OU=Test,OU=blah,DC=blah,DC=blah"])]

  conn.modify(dn, mod)
rescue LDAP::ResultError

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.