Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.
Sign up to join this community
We want to migrate our user-accounts from OpenLDAP to Active-Directory without changing the passwords and such. The users shouldn't notice the difference against which server they're authenticating then.
How-to-create-active-directory-user-account-with-powershell is a very interesting approach, but since the passwords are stored encrypted it is not working for us.
What are possible solutions / setup for our task?
OpenLDAP Version: 2.1 on SuSE, Windows Server 2008
Unlikely you'll be able to get the passwords out of OpenLDAP unless it operates in a manner different than the typical directory.
What some customers do in this scenario is stand up a middle layer for authentication that first checks the user's password against the source and then writes it to AD if it is valid prior to authenticating them. If you do this with a few key services, over a short period of time you'll capture most of the passwords.
For the import, if you can dump your data in CSV format, CSVDE works well for bulk-importing into AD. We recently migrated a couple of hundred users from eDirectory to AD with this, and it went very well. I can't answer your password question, as when we did it we just set the "must change password on next logon" bit and got the users to do it themselves.
