0

I created a test domain and copied the OU structure and user accounts to it from my existing domain using ldifde as described in the KB below. Unfortunately, this did not copy the groups, or the group membership.

I am trying to use the following command to export groups with membership.

ldifde -f export_Groups_WITH_Members.ldf -s -d "" -p subtree -r "(&(ObjectCategory=group)(objectClass=group)(name=)(member=))" -l "member" -j c:\

This seems to work as I get an ldf file with what looks like all of the group and membership information, however, after I replace the old domain dn with the new domain dn and try to import it, I get the following error:

ldifde -i -k -f export_Groups_WITH_Members.ldf -s prodef-dc-01 -v

......

Importing directory from file "export_Groups_WITH_Members.ldf" Loading entries 1: CN=XXX,OU=XXX,OU=XXX,OU=XXX,DC=XXX,DC=CATS,DC=XXX,DC=XX

Add error on entry starting on line 1: Object Class Violation The server side error is: 0x207b The object class attribute must be specified. The extended server error is: 0000207B: UpdErr: DSID-030511CF, problem 6002 (OBJ_CLASS_VIOLATION), data 0

Improve this question

1 Answer 1

Reset to default
1

You might prefer the Active Directory Migration Tool for doing stuff like this. You will need a trust between the two domains, though, and you'll probably lose password info (although you would with ldifde, too).

Improve this answer
4
  • As far as I know, ADMT will only move objects. Please correct me if I am wrong. Also, you can use Microsoft's Password Export Server to move passwords with users when using ADMT. I need to copy groups and group membership so that I have the same groups, users, and membership in the new test domain.
    – TonyD
    Jan 15, 2013 at 16:08
  • Back when I tried it, it copied mine but YMMV. From what I hear, ADMT v2 always copied, but ADMT v3 will move objects if you are migrating to a domain in the same forest and copy if you are migrating to a domain in a different forest. And PES is supposed to be the right tool for passwords, but you need to jump through hoops to get it working (rebooting domain controllers, storing passwords with reversable encyption, etc). We gave up in the end -- the requirement went away!
    – jimbobmcgee
    Jan 15, 2013 at 17:38
  • If you are absolutely unsure and want to be certain, you'll need to make two brand new forests (e.g. in a series of secluded VMs) and test your process between them, before you actually do this on your live AD. You know -- a test to test your migration to test!
    – jimbobmcgee
    Jan 15, 2013 at 17:40
  • Thanks, I am configuring ADMT right now to try to get this working. The copy will happen "interforest" so I will try to get ADMT to copy and let you know how it goes. Hopefully some of our requirements will also go away!
    – TonyD
    Jan 15, 2013 at 17:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .