Is there any way to update the same field in multiple accounts at the same time?

October 3, 2006 2:27 PM

Active Directory filter>> Is there any way to update the same field in multiple accounts at the same time?
posted by Cosine to computers & internet (11 comments total)

Yes - there are many ways to doin mass updates, but my preferred way is Ldifde.
posted by deadmessenger at 2:40 PM on October 3, 2006

ugh, editing fart - "doin" should have read "do" in that comment.
posted by deadmessenger at 2:41 PM on October 3, 2006

Thanks, I thought of that and all the usual command line utilities but I don't think they will help as I need to pick and choose certain computer accounts and then edit the selected accounts so they all have certain fields the same way, I think this is too tall an order for a command line util.
posted by Cosine at 2:51 PM on October 3, 2006

You can still do that with LDIFDE. Just do an export of all accounts of objectClass = computer, and edit the resulting file to remove the computer accounts you don't want to change, then update the field. If you're talking about hundreds of accounts, it still beats the crap out of using ADUC.

Start with something like this:

ldifde -f ADComputerAccounts.ldf -r (objectClass=computer)
posted by deadmessenger at 3:00 PM on October 3, 2006

ah, ok, I'll start with that.
posted by Cosine at 3:06 PM on October 3, 2006

I'll second the suggestion of ldifde, but if you want to use the GUI (Active Directory Users and Computers) you can select and edit multiple accounts - just right click - properties.

Just be careful to edit only the fields you want to make identical in the selected accounts.
I think you may also be able to do this from a search result list too.
posted by Lanark at 3:10 PM on October 3, 2006

Lanark, can you explain more, how can I get to properties for more than one item?
posted by Cosine at 3:12 PM on October 3, 2006

Forget it, turns out Microsoft has a free tool ADmodify.net that works very well. Thanks anyway.
posted by Cosine at 3:30 PM on October 3, 2006

The security folks at my job have mentioned Hyena, but never said enough for me to know anything about it.
posted by hootch at 3:37 PM on October 3, 2006

I just checked out Hyena, wow, awesome, it's my new fav toy.
posted by Cosine at 4:22 PM on October 3, 2006

You could always learn ADSI (through VBScript preferably). There are also a number of command-line tools available in Windows Server 2003 that used to be part of the resource kits (dsmod, dsquery, dsadd...).

That Hyena link is interesting though. Haven't heard of it before. It really depends on the number of accounts you're referring to though. GUI's are great if you're only dealing with a smallish number of accounts, but once it gets into the thousands (if it does) the GUI tools start to get a lot more cumbersome.
posted by purephase at 7:16 PM on October 3, 2006