Welcome to NNS ADix - the Active Directory(R) Import Export Tool!

looking for solutions. not for excuses.
Welcome to NNS ADix v3 - the Active Directory(R) Import Export Tool!

ADix v3 is a tool for Microsoft(R) Active Directory(R) bulk import/export.

If you need more information or you want to submit a support call,
use one of the ADix Web Resource links below:

ADix support
  • Submit a support call
  • NNS ADix v3 FAQs
  • Product Knowledge Base

More ADix informations
  • NNS ADix v3 release notes
  • NNS ADix v3 Home
  • NNS Home
Copyright © 2008 by NNS - Nigl Network Solutions


NNS ADix - Release Notes

NNS ADix - Release Notes (Version 3.5.17)

Welcome to the NNS ADix Release Notes!

Please refer to these release notes to obtain the latest information about installation/upgrade,
new features, bug fixes and support.

  • What's new
  • Installing NNS ADix 3
  • Known Problems and Limitations
  • Technical Support

What's New

New and Improved Features

NNS ADix 3.5 Build 17 contains the following new and improved features:

  • Import and Export of Pictures:
    You can now directly import pictures from JPEG-, PNG- and GIF-files into Active Directory. Further you can
    export pictures from Active Directory to JPEG-files.
    See the help topic NNS ADix - How to...Import or Export Pictures for more information.

Bug Fixes

NNS ADix 3.5 Build 17 contains the following bug fixes:

  • AD Import - Removing Values from Terminal Services Attributes:
    You receive errors when removing/clearing the values for some Terminal Services attributes.
    This issue has been fixed.

Installing NNS ADix v3

Prerequisites for NNS ADix v3:

  • Windows XP, Windows Vista, Windows 7, Windows Server 2003, Windows Server 2008, Windows Server 2008 R2
  • The Microsoft .NET Framework 2.0 must be installed on the computer where NNS ADix will be installed
  • Administrative permissions on the computer where NNS ADix will be installed
  • Access to a Microsoft Active Directory Domain for post installation tasks
  • Remote Server Administration Tools (RSAT, prior ADMINPACK) for export/import of Terminal Services (Remote Desktop
    Services) related attributes

Note:
In order to run NNS ADix and use all features after the installation, a connection to an Active Directory Domain
must be possible. If a connection to AD could not be established, NNS ADix will be started in Offline Mode.
(See the Help Topic "Running NNS ADix in Offline Mode" for more information).

Note:
NNS ADix can but need not to be installed on an Active Directory Domain Controller. The advantage of running NNS ADix
on an AD Domain Controller is the minimized network traffic. This is especially the case if you perform queries which are
returning a large number of objects (e.g. all user objects).

Known Problems and Limitations

  • Support for Windows 2000:
    In NNS ADix v3 we are using some features which are not supported on Windows 2000 (e.g. "Attribute Scoped Queries").
    Therefore we do not support the installation of NNS ADix v3 on a Windows 2000 platform.

Note:
Running NNS ADix v3 on an supported OS and exporting/importing AD objects which are stored in an W2k AD is supported.

  • Running NNS ADix v3 on a W2k8/W2k8 Domain Controller:
    If you run NNS ADix on a W2k8/W2k8 R2 Domain Controller and you want to import data, you must start NNS ADix with
    elevated privilges (run as administrator)    . Otherwise you will get an "Access denied error" on every object and attribute you
    want to import despite you have sufficient permissions in AD.

Technical Support

If you have a technical question about NNS ADix...

  • Use this documentation,
  • look up the NNS ADix v3 FAQs or
  • submit a support call.


NNS ADix - End-User License Agreement (EULA)

IMPORTANT - READ CAREFULLY: This End-User Licence Agreement ("EULA") is a legal agreement between you
(either an individual or a single entity) and Nigl Sascha for the software product "NNS ADix", which includes computer
software and may include associated media, printed materials, and "online" or electronic documentation
("SOFTWARE PRODUCT"). By installing, copying, or otherwise using the SOFTWARE PRODUCT, you agree to be bound
by the terms of this EULA. If you do not agree to the terms of this EULA, do not install or use the SOFTWARE PRODUCT.
The SOFTWARE PRODUCT is licensed, not sold.

GRANT OF LICENSE

This EULA grants you the following rights to the SOFTWARE PRODUCT:

1. Installation. The SOFTWARE PRODUCT be obtained by "electronic software distribution" such as File Download from the Internet.
You may install the software from the provided media in the following manner:

2. SOFTWARE PRODUCT. You may install the SOFTWARE PRODUCT on the number of machines as you have purchased licenses.
You can use the same license data, but you have to purchase licenses of the SOFTWARE PRODUCT based on the number of
machines you install the SOFTWARE PRODUCT.

3. Evaluation. If you have installed a ‘trial’ version of the software, you will automatically have a License allowing you to install
the SOFTWARE PRODUCT on one machine for the purpose of evaluating the usefulness of the software. This license is valid
for a limited number of days only. On expiration of the trial license, you must either purchase a valid license to convert the
evaluation software into the commercial version or alternatively completely 'uninstall' the SOFTWARE PRODUCT from the machine
on which it was installed.

4. Upgrades. The SOFTWARE PRODUCT is stamped with a Version Code consisting of a major and a minor version number. If you acquire
a License for Version 2.0 of the SOFTWARE PRODUCT, you will be enabled to download later upgrades and enhancements from our
Web Site provided only that the major version is the same. For example, acquiring a license for version "2.0" allows you to upgrade to
"2.1" but not to "3.0".

6. Transfer. You may transfer the SOFTWARE PRODUCT to another computer, provided that it is removed from the computer from which it is transferred.

DESCRIPTION OF OTHER RIGHTS AND LIMITATIONS

7. For all SOFTWARE Rental. You may not rent or lease the SOFTWARE PRODUCT.

8. Limitation on Reverse Engineering, Decompilation, and Disassembly. You may not reverse engineer, decompile, or disassemble
the SOFTWARE PRODUCT, except and only to the extent that such activity is expressly permitted by applicable law notwithstanding this limitation.

9. Termination. Without prejudice to any other rights, Nigl Sascha may terminate this EULA if you fail to comply with the terms and conditions of
this EULA. In such event, you must destroy all copies of the SOFTWARE PRODUCT and all of its component parts.

COPYRIGHT

10. The SOFTWARE PRODUCT is licensed, not sold. Title and copyrights in and to the SOFTWARE PRODUCT (including any images, applets, photographs,
animations, video, audio, music, and text incorporated into the SOFTWARE PRODUCT ), accompanying printed materials, and any copies you are
permitted to make herein are owned by Nigl Sascha or his suppliers and are protected by Austrian copyright laws and international treaty provisions.
Microsoft®, Active Directory® and Windows® are registered trademarks of the Microsoft Corp.
Lumenworks CSV Reader written by Sébastien Lorion is licensed under the The Code Project Open License (CPOL) (many thanks for this excellent work!).

DISCLAIMER OF WARRANTY

11. THIS SOFTWARE AND ITS ACCOMPANYING WRITTEN MATERIALS ARE PROVIDED BY LICENSOR "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT,
ARE DISCLAIMED.

12. IN NO EVENT SHALL LICENSOR OR ITS SUPPLIERS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, SAVINGS, OR PROFITS;
OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Because some states do not allow the exclusion or limitation of liability for consequential or incidental damages, the above limitation may not apply to you.

© Nigl Sascha 2008. All Rights Reserved.
2008-12-15


NNS ADix - Acknowledgements

We would like to thank Sébastien Lorion (Lumenworks) for his excellent CSV Reader which we use in NNS ADix v3.
Lumenworks CSV Reader is licensed under the The Code Project Open License (CPOL).

Further we would like to thank Joe Kaplan and Ryan Dunn for their excellent book "The .NET Developer's Guide to
Directory Services Programming" (Addison-Wesley), which gave us many valuable hints regarding Active Directory programming.

Again, many thanks for this excellent work!


NNS ADix - Setup

Welcome to the setup topics!
This section provides general information about installation requirements and procedures.
If you are having problems with the NNS ADix installation, review this information to be sure your
environment meets the system requirements for installing and running NNS ADix.

This section contains the following topics:

  • System requirements: Required and recommended software/hardware
  • Installation: The ADix installation process
  • Uninstallation: How to remove ADix from your computer


NNS ADix - System Requirements

Software Requirements

Please be sure that the following software is installed on the computer prior to the installation of NNS ADix:

  • Windows XP, Windows Vista, Windows 7, Windows Server 2003, Windows Server 2008 or Windows Server 2008 R2
  • Microsoft .Net Framework 2.0
  • Remote Server Administration Tools (RSAT, prior ADMINPACK) for export/import of Terminal Services (Remote Desktop
    Services) related attributes

Further make sure that you have...

  • ...administrative permissions on the computer where NNS ADix will be installed
  • ...access to a Microsoft Active Directory Domain for post installation tasks

Note:
In order to run NNS ADix and use all features after the installation, a connection to an Active Directory Domain
must be possible. If a connection to AD could not be established, NNS ADix will be started in Offline Mode.
(See the Help Topic "Running NNS ADix in Offline Mode" for more information).

Note:
NNS ADix can but need not to be installed on an Active Directory Domain Controller. The advantage of running NNS ADix
on an AD Domain Controller is the minimized network traffic. This is especially the case if you perform queries which are
returning a large number of objects (e.g. all user objects).

Hardware Requirements

In order to run NNS ADix with appropriate performance, we recommend...:

  • ...an Intel Pentium or compatible 1500-Mhz processor
  • ...512 MB RAM
  • ...a 1280x1024 or higher resolution monitor


NNS ADix - Uninstallation

Uninstallation Procedure

In order to uninstall NNS ADix perform the following steps:

  • From the Start menu choose Settings and then Control Panel
  • In the Control Panel double-click Add/Remove Programs
  • Select NNS ADix
  • Click the Remove button
  • Click Yes on the confirmation dialog


NNS ADix - Installation

Installation Procedure

In order to install NNS ADix perform the following steps:

  • Expand the content of the installation archive into a temporary directory
  • Double-Click the installation file setup.exe
  • On the Welcome page of the Setup Wizard click Next
  • Read the license agreement on the License Agreement page.
    Only if you accept all the terms of the license agreement, select I Agree and click Next
  • On the Installation Folder page select the folder into which to install NNS ADix and click Next
  • On the Confirm Installation page click Next to start the installation process
  • On the Installation Complete page, which is displayed after successful installation, click Close


NNS ADix - User Guide

Welcome to the user guide topics!
This section provides basic information about using the NNS ADix features.

The section contains the following topics:

  • Exporting AD Objects: Describes how to export Active Directory objects using the AD Export Wizard
  • Importing AD Objects: Describes how to import Active Directory objects using the AD Import Wizard
  • Using Attribute Files: Describes the purpose and use of attribute files
  • Using Query Filters: Describes the purpose and use of query filters
  • Using Job Definitions: Describes the purpose and use of job definitions
  • Scheduling Jobs: Describes how to schedule a saved job definition
  • Using Object Class Definitions: Describes the purpose and use of object class definitions
  • Viewing Log Files: Describes how to view export/import log files
  • Using NNS ADix Converters: Describes how to convert GUIDs or SIDs
  • Using the AD Browser: Describes how to use the Active Directory browser
  • Viewing the NNS ADix System Information: Describes how to view and save the NNS ADix system information
  • Running NNS ADix in Offline Mode: Describes which features are available in Offline Mode
  • Running NNS ADix from the Command Line: Describes how to run NNS ADix from the command line


NNS ADix - Exporting AD Objects

General Information:

NNS ADix enables you to export Active Directory objects into a text-based file. You can export Active Directory
objects by running the ADix GUI or by running ADix from the command line.

Exporting AD Object using the AD Export Wizard:

The AD Export Wizards guides you through the process of exporting Active Directory objects. This wizard is available
only in the ADix GUI.

To export AD objects using the AD Export Wizard...

  • Start the AD Export Wizard. The AD Export Wizard can be started by pressing CTRL-X, by
    selecting File->AD Export Wizard from the main menu or by clicking AD Export from the console tree and
    selecting the Export Wizard tab.
  • The AD Export Wizard appears on the screen. Click Next to continue the wizard. The Select Query Filter
    dialog appears on the screen.
  • In the Select Query Filter dialog click Select a Query Filter to choose an existing query filter. The
    Query Filter Selector dialog appears on the screen. Select a query filter and click OK. The query filter settings from
    the selected query filter will be applied to the Select Query Filter dialog. You can edit the settings as needed.
    Click Next to continue the wizard.
  • The Set Referral Chasing Option dialog appears on the screen. Select the referral chasing option you want to
    use and click Next.
  • The Select Attributes dialog appears on the screen. Specify the attributes you want to export. You can either
    enter the lDAPDisplayNames of the attributes directly in the text box or you can select the attributes from an attribute
    file     by clicking the Select Attributes to Export button.
    If you choose the latter method, the Select Attributes for Export dialog will be displayed. Select the attributes you want
    to export and click OK to close this dialog. The selected attributes are added to the attributes text box.

    Note:
    The attributes specified for export must be delimited by a semi-colon!

  • The Set Export Operation Settings dialog appears on the screen. Specify the following options:
    • Export group membership using the pre-windows 2000 logon name (sAMAccountName):
      The group members/group membership will be exported using the pre-windows 2000 logon names (sAMAccountName)
      instead of the distinguished names.
    • Export the object class for each object to export (derived from 'objectClass'-hierarchy; attribute 'class'):
      Select this option if the object class should be exported.
    • Export the object path for each object to export (attribute 'path'):
      Select this option if the object path should be exported.
    • Export the objectGUID path for each object to export (attribute 'GUIDPath'):
      Select this option if the objectGUID path should be exported.
    • Enable multi-threading for this export job:
      Select this option to enable multi-threading. The export operation will be done with up to 4 threads.
      Enabling this option will decrease export time, but will put more load on the Domain Controllers.

    Click Next to continue.

    Note:
    In order to create objects using a recently created export file, the option to export the object path must be enabled. To
    update existing objects, the option to export the object path or the GUID path must be enabled.

  • The Set Export File Settings dialog appears on the screen. Specify export file, export log and the field delimiters/text qualifiers which should be used for the export file. Any existing files will be overwritten. Click Next to continue.

    Note:
    We recommend to use a text qualifier that is not part of any attribute value (e.g. if an attribute value contains
    double quotes, use single quotes as text qualifier.

    Note:
    If an attribute value contains a CRLF (Carriage Return/Line Feed), the CRLF will be replaced by the string \CRLF\ in the
    export file.

  • Next the Task Summary dialog appears on the screen. Review the settings and click Start Export to invoke the
    export operation or click Save Settings to save the settings in an Export Job Definition for later use.
  • The AD Export Operation dialog will be displayed during the export operation. The current operation can be canceled
    by clicking the Cancel button.
    After the operation has been finished, the export log file can be viewed by clicking on the View the log file button. Further
    the export file can be opened by clicking on the Open the export file button.

Related Help Topics:

  • AD Export > Export Wizard
  • AD Export > Export Job Definitions
  • Using Attribute Files
  • Using Query Filters
  • Using Job Definitions


NNS ADix - Importing AD Objects

General Information:

NNS ADix enables you to import Active Directory objects from a text-based file. You can import Active Directory
objects by running the ADix GUI or by running ADix from the command line.

The objects to be imported are identified either by the object path or by the objectGUID path. The import file must contain
the attribute 'path' to create/update objects or the attribute 'path'/'GUIDPath' to update existing objects.

Creating new Objects:

New objects will be created if...

  • the creation of new objects is enabled,
  • the import file contains the attribute 'class' (specifies the object class of the object to create; e.g. user, group, ...),
  • the import file contains the attribute 'path' (this is the object path for the object to create),
  • the import file contains all required mandatory attributes for the given object class and
  • the parent object path of the object to create already exists.

Updating Objects:

In order to update existing objects, these objects must be identified. NNS ADix identifies objects by a so-called
'key attribute'. This key attribute must be present in the import file (see Set Import File Settings dialog later in this topic).
We recommend to use the attribute 'path' or the attribute 'GUIDPath' as key attribute, although other attributes can be used
as key attribute.
The attribute 'path' represents the object path while the attribute 'GUIDPath' represents the GUID of an object.

We recommend to use the 'GUIDPath' whenever possible, because the value of this attribute never changes. The value
of the attribute 'path' can be changed (e.g. renaming or moving an object). Therefore, if you want to periodically exchange data
with a Data Warehouse, we strongly recommend to use the 'GUIDPath' as key, because this attribute can't be changed.

Updating the attribute values of an object is per default a replace operation. This means that current attribute values will be replaced
by the values specified in the import file.
The only exceptions are the attributes 'member' and 'memberOf'. You can choose whether to replace the existing values or add the
values provided in the import file (see Set Import File Settings dialog later in this topic).

In order to add attribute values for other attributes than 'member' or 'memberOf', you must prefix the attribute value with the string
\ADD\ (see the help topic How to...Add an Attribute Value for more information).

In order to delete an attribute value, use the string \CLR\ as attribute value in the import file
(see the help topic How to...Clear an Attribute Value for more information).

Deleteing Objects:

In order to delete an Active Directory object, the value of the ADix auxiliary attribute 'adixDel' in the import file must be set to 'DELOBJ'
for a single object deletion or to 'DELTREE' to delete an entire object tree.
(see the help topic How to...Delete Active Directory Objects for more information).

Importing AD Object using the AD Import Wizard:

The AD Import Wizards guides you through the process of importing Active Directory objects. This wizard is available
only in the ADix GUI.

To import AD objects using the AD Import Wizard...

  • Start the AD Import Wizard. The AD Import Wizard can be started by pressing CTRL-I, by
    selecting File->AD Import Wizard from the main menu or by clicking AD Import from the console tree and
    selecting the Import Wizard tab.
  • The AD Import Wizard appears on the screen. Click Next to continue the wizard.
  • The Set Import File Settings dialog appears on the screen. Specify import file, import log and the field delimiters/text
    qualifiers     which should be used. If you are updating existing objects, specify the Update key attribute. This attribute must
    be present in the import file and will be used to identify existing objects. At last click the Validate Import File button to
    validate the structure of the import file. Review the validation state and click Next to continue.
  • The Set Import Operation Settings dialog appears on the screen. Specify the following options:
    • If object does not exist, create a new object:
      Select this option to enable the creation of new objects.
    • Enable newly created objects of type user, computer or INetOrgPerson:
      Select this option if the newly created objects of the types listed above should be enabled.
      This setting is only relevant for security principals.
    • Use the pre-Windows 2000 logon name (sAMAccountName) when updating group membership:
      The group membership will be imported using the pre-windows 2000 logon names (sAMAccountName)
      instead of using the distinguished names of the group members.
    • Clear the current group membership of an object (attribute 'memberOf') before importing the new group membership:
      Select this option if the group membership of the object should be replaced by the values specified in the import file.
    • Clear the current group members of an object (attribute 'member') before importing the new group members:
      Select this option if the group members of the object should be replaced by the values specified in the import file.
      This option is only relevant for objects of type 'group'.
    • Enable multi-threading for this import job:
      Select this option to enable multi-threading. The import operation will be done with up to 4 threads.
      Enabling this option will decrease import time, but will put more load on the Domain Controllers.

    Click Next to continue.
  • Next the Task Summary dialog appears on the screen. Review the settings and click Start Import to invoke the
    import operation or click Save Settings to save the settings in an Import Job Definition for later use.
  • The AD Import Operation dialog will be displayed during the import operation. The current operation can be canceled
    by clicking the Cancel button.
    After the operation has been finished, the import log file can be viewed by clicking on the View the log file button. Further
    the import file can be opened by clicking on the Open the import file button.

Related Help Topics:

  • AD Import > Import Wizard
  • AD Import > Import Job Definitions
  • Using Job Definitions
  • How to...Clear an Attribute Value
  • How to...Add an Attribute Value


NNS ADix - Using Attribute Files

General Information:

Attribute files are used to store a list of Active Directory attributes. You can use this list of attributes to simplify
the attribute selection while running the AD Export Wizard or configuring an Export Job definition.

The attribute definitions are stored in an XML-file. You can configure multiple files and adjust them
to your needs.

Managing Attribute Files:

After starting NNS ADix for the first time, two Attribute Files will be provided:
- AllAttributes.att (contains all attributes which are included in an Active Directory schema with
Microsoft Exchange Server 2003 installed; this is the default attribute file)
- ComAttributes.att (contains commonly used attributes)

You can create additional Attribute Files or edit existing ones.

To create an Attribute File...

  • Select Configuration from the console tree and select the Attribute Files tab
  • Right-click the details pane and select New->Attribute File from the context menu. The
    Create a new Attribute File dialog appears on the screen.
  • Type a name for the Attribute File in the field Name. Provide the physical file name in the field File Name.
    You can also specify a description in the Description field.
  • Click the Create button to create the new Attribute File. After the new file was successfully created,
    a dialog appears asking you, if you want to edit the properties of the new attribute file.
  • Click Yes to edit the properties of the new Attribute File or No to finish this task.

To edit an existing Attribute File...

  • Right-click an existing Attribute File and select Properties from the context menu. The
    Edit Attribute File dialog appears on the screen.
  • Make changes as needed and click OK to save the Attribute File.

To export existing Attribute Files...

  • Select the Attribute Files you want to export
  • Right-click one of the selected Attribute Files and select Export Attribute File from the context menu.
    The Browse For Folder dialog appears on the screen.
  • Select a folder where the Attribute File should be placed and click OK to export the Attribute Files.

To import existing Attribute Files...

  • Right-click the Attribute Files details pane and select Import Attribute File from the context menu.
    The Import Attribute Files dialog appears on the screen.
  • Select the Attribute Files to import and click Open to import the files.

Using the Attribute Files Properties Dialog:

This dialog provides information about the Attribute File, the attributes contained in the file and
the properties of these attributes.

Further this dialog enables you to...
- Add new attributes
- Edit existing attributes
- Delete existing attributes
- pre-select attributes when when choosing attributes for export (Export Job Definitions/AD Export Wizard)

Note:
All changes made on an attribute file are completely independent from the Active Directory schema. Add, edit or
delete operations have only impact on the current attribute file.

Add new Attributes:

To add new attributes...

  • Click the Add button on the bottom of the list of attributes. The Add Attribute dialog will be displayed.
  • Provide an attribute name in the Attribute name (lDAPDisplayName) field. This is the name which
    can be used in query filters.
  • Provide an attribute display name in the Attribute display name field. This is a description for the attribute.
  • Select whether this attribute is pre-selected when choosing attributes for export
  • Click OK to create the attribute.
  • Click OK to save the attribute file.

Edit existing Attributes

To edit existing attributes...

  • Right-click an existing attribute and Click the Properties button on the bottom of the list of attributes.
    The Edit Attribute dialog appears on the screen.
  • Make changes as needed and click OK to close the attribute properties dialog.
  • Click OK to save the attribute file.

Delete existing Attributes

To delete existing attributes...

  • Select the attributes you want to delete and click the Delete button on the bottom of the list of attributes.
  • Confirm the attribute deletion by clicking the Yes button on the confirmation dialog.
  • Click OK to save the attribute file.

Pre-Select Attributes

To pre-select attributes...

  • Select the attributes you want to pre-select and click the Change attribute pre-selection button
    on the bottom of the list of attributes.
  • Attributes assigned for pre-selection will be tagged with the AD Export image on the left side of the attribute.
  • Click OK to save the attribute file.

Note:
The pre-selection can be canceled by selecting the appropriate attributes and clicking the Change attribute pre-selection
 button again.

Related Help Topics:

  • Configuration > Attribute Files
  • Attribute File Properties > Edit Attribute Properties Page
  • Exporting AD Objects


NNS ADix - Using Query Filters

General Information:

Query Filters are used to find Active Directory objects based on selection criteria (query). Query Filters
are primarily used in export operations.

Managing Query Filters:

After starting NNS ADix for the first time, five Query Filters will be created per default:
- Computer Objects (Queries for computer objects)
- Contact Objects (Queries for contact objects)
- Group Objects (Queries for group objects)
- OU Objects (Queries for organizational unit objects)
- User Objects (Queries for user objects)

You can create additional Query Filters or edit existing ones.

To create a Query Filter...

  • Select AD Export from the console tree and select the Query Filters tab
  • Right-click the details pane and select New->Query Filter from the context menu. The
    New Query Filter dialog appears on the screen.
  • Type a name for the current Query Filter in the field Name. You can also specify a description in the Description field.
  • Specify a Query Root, which represents both the binding context that will be used to connect to AD and the starting point
    for the query.

    Note:
    The query root must always start with LDAP: or GC: (use GC: to perform a Global Catalog search;
    use this moniker to search an entire forest). The monikers LDAP: and GC: are case sensitive, so always write them in capital letters!

  • Select the depth of search by selecting/deselecting the option Include subcontainers
  • Select whether deleted objects should be included or not by selecting/deselecting the option Include deleted objects
  • Select whether you want provide credentials (username and password) other than the current ones when browsing for
    a Query Root or when previewing the query results.

    Note:
    Enabling this option will have no impact when using the query in an export operation.

  • Add the filter conditions in the field Query Filter string. You can do this manually or by clicking the
    Edit Query button to select from a list of attributes and conditions. Clicking this button will open the
    Edit Query dialog. Choose the fields and conditions you need and click OK. The query appears in the
    Query Filter text box.

    Note:
    NNS ADix v3 only supports LDAP search filters. For more information about LDAP search filters see
    Appendix C: LDAP Search Filters.

  • Click the Advanced tab to specify advanced settings
  • Provide the Referral Chasing Options which should be used.
  • Click OK to save the Query Filter.

Note:
To see the results of the query filter click the Preview button. The query will be executed and the results will
be displayed in the Query Filter Preview dialog. See the section Using the Query Filter Preview Dialog later in this topic
for more information.
We recommend to preview and review the results of a query before using the query in an export operation. Doing so will
ensure that you really export the objects you want.

To edit an existing Query Filter...

  • Right-click an existing Query Filter and select Properties from the context menu. The
    Edit Query Filter dialog appears on the screen.
  • Make changes as needed and click OK to save the Query Filter.

To export existing Query Filters...

  • Select the Query Filters you want to export
  • Right-click one of the selected Query Filters and select Export Query Filter from the context menu.
    The Export Query Filters dialog appears on the screen.
  • Provide a file name and click Save to save the Query Filters into an XML-file.

To import existing Job Definitions...

  • Right-click the container in the Query Filters console tree where the filters to import should be placed
  • Select Import Query Filter from the context menu. The Import Query Filters dialog appears on the screen.
  • Select the file which contains the filters to import and click Open to import the Query Filters.

Using the Query Filter Preview Dialog:

The results of a Query Filter can be displayed by clicking on the Preview button. This will execute the query using the
specified parameters and the search results will be displayed in the Query Filter Preview dialog.

This dialog enables you to...
- View the attributes/attribute values of the objects returned by the query
- Reanimate Active Directory tombstones

View Attributes/Attribute Values:

To view attributes/attribute values...

  • Double-click on an object displayed in the Query Filter Result list or click the Properties button
    displayed on the bottom of the list. The Object Properties dialog will be displayed.
  • Click OK to close Object Properties dialog.

Reanimate Tombstones:

To reanimate tombstones...

  • Select a tombstone (deleted object) displayed in the Query Filter Result list and click the
    Reanimate Tombstone button displayed on the bottom of the details pane.
    The Reanimate Tombstone dialog will be displayed.
  • Click Start Reanimation to reanimate the selected tombstones.
  • Click Close to close the tombstone reanimation dialog.

Related Help Topics:

  • Appendix C: LDAP Search Filters
  • How to...Reanimate Active Directory Tombstones
  • AD Export > Query Filters > Query Filter Properties


NNS ADix - Using Job Definitions

General Information:

Job Definitions are used to save the settings which should be used in an export/import operation. Job Definitions can
be created from scratch or by saving the settings provided in an export/import operation. These jobs can be started
either by using the ADix GUI or by running NNS ADix from the command line.

Further the jobs can be scheduled to run at specific times (useful if you want to periodically
exchange data between Active Directory and a Data Warehouse) or can be used in batch-files/scripts.

Managing Job Definitions:

NNS ADix provides two types of Job Definitions:
- AD Export Job Definitions and
- AD Import Job Definitions.

The following description is valid for both export and import job definitions.

To create a Job Definition...

  • Select AD Export (AD Import) from the console tree and select the Export (Import) Job Definitions tab
  • Right-click the details pane and select New->Export (Import) Job Definition from the context menu. The
    New Export (Import) Job Definition dialog appears on the screen.

    Note:
    Alternatively you can create a Job Definition by clicking on the Save Settings button at the last page
    of the Export (Import) Wizard.

  • Type a name for the current Job Definition in the field Name/ID. You can also specify a description in the Description field.

    Note:
    The job ID will be set automatically und must be used when running NNS ADix from the command line.

  • Fill the remaining fields with the desired values.

    Note:
    When creating an Export Job Definition, you can select an existing Query Filter. The Job Definition will be
    saved completely independent from the Query Filter. So if you make any changes to the query parameters
    used in the job definitions query filter, this changes does not have any impact on the selected Query Filter and vice versa.

  • Click OK to save the Job Definition

To edit an existing Job Definition...

  • Right-click an existing Job Definition and select Properties from the context menu. The
    Edit Export (Import) Job Definition dialog appears on the screen.
  • Make changes as needed and click OK to save the Job Definition.

To export existing Job Definitions...

  • Select the jobs you want to export
  • Right-click one of the selected Job Definitions and select Export Job Definition from the context menu.
    The Export Job Definitions dialog appears on the screen.
  • Provide a file name and click Save to save the Job Definitions into an XML-file.

To import existing Job Definitions...

  • Right-click the container in the Job Definitions console tree where the jobs to import should be placed
  • Select Import Job Definition from the context menu. The Import Job Definitions dialog appears on the screen.
  • Select the file which contains the jobs to import and click Open to import the Job Definitions.

Related Help Topics:

  • Scheduling Jobs
  • Running NNS ADix from the Command Line
  • AD Export > Export Job Definitions
  • AD Import > Import Job Definitions


NNS ADix - Scheduling Jobs

General Information:

NNS ADix enables you to run AD Export/AD Import operations at specific times. This feature is very useful
for periodic data exchange with e.g. a Data Warehouse.

You can schedule Job Definitions directly from the ADix GUI. The actual scheduled job is not stored in the
NNS ADix configuration file. Instead an entry in the Windows Task Scheduler is made. Therefore you
can also manage the jobs using the Windows Task Scheduler.

Scheduling Jobs:

To run schedule a job...

  • Right-click an Export/Import Job Definition and select Schedule the selected job from context menu.
    The Create a new ADix Export/Import Job dialog appears on the screen.
  • Type a name for the scheduled job in the field Job name. You can also provide a description
    in the Description field.

    Note:
    Every job created with the ADix GUI is automatically prefixed with "[ADix3 Export Job]" or "[ADix3 Import Job]".
    The prefix ensures that only ADix jobs are displayed in the ADix GUI. We recommend to not change this prefix
    in the Windows Task Scheduler.

  • Provide the credentials (username and password) which will be used when the job runs.
  • Click OK to create the scheduled job
  • Next the Windows Task Scheduler dialog appears on the screen. Provide a schedule for the job.
    Click OK to save the settings you have made.

Note:
You can view a list of already scheduled export/import jobs by selecting the Scheduled Export Jobs/Scheduled Import Jobs
 tab in the ADix GUI. A list of all scheduled export/import jobs together with some other information (e.g. schedule,
last run time, ...) will be displayed on the screen.

To edit a scheduled job...

  • Select the Scheduled Export Jobs/Scheduled Import Jobs tab to display a list of already scheduled jobs
  • Right-click the job you want to edit and select Properties from the context menu
  • The Windows Task Scheduler dialog appears on the screen. Edit the job settings and
    click OK to save the settings you have made.
  • Next the Windows Task Scheduler dialog appears on the screen. Provide a schedule for the job.
    Click OK to save the settings you have made.

    Note:
    To rename or copy a scheduled job use the Windows Task Scheduler.

To delete a scheduled job...

  • Select the Scheduled Export Jobs/Scheduled Import Jobs tab to display a list of already scheduled jobs
  • Right-click the job you want to edit and select Delete from the context menu
  • Confirm the deletion in the Delete Item dialog

Related Help Topics:

  • AD Export > Export Job Definitions > Create Export Job Properties
  • AD Import > Import Job Definitions > Create Import Job Properties


NNS ADix - Using Object Class Definitions

General Information:

Object class definitions are used for import operations exclusively. An object class definition provides
information which attributes are mandatory for an object class.

An object class definition is necessary for every object class you want to create an object.
E.g. if you want to create an object of class "user", there must be a corresponding object class available.

NNS ADix provides some basic object class definitions. You can add new ones or edit existing object class
definitions.

Note:
The mandatory attributes set in an object class definition are independent from the mandatory attributes
defined in the Active Directory Schema. However, an object class definition must contain at least the
mandatory attributes dictated by the schema.

Related Help Topics:

  • Appendix D: Object Classes and Mandatory Attributes
  • AD Import > Object Class Definitions


NNS ADix - Viewing Log Files

General Information:

During every AD Export/Import operation a log file is written. The log file contains general information like
operation start time/end time, the settings used for the operation and some statistics.

Further the log file contains detailed information regarding an exported/imported object down to the attribute
level.

Viewing Log Files:

To view a log file...

  • Select Toolbox from the ADix console tree and select ADix Log File Viewer from the list view
    The Load ADix Log File dialog appears on the screen.
  • Select the log file you want to view and click Open
  • The ADix Log File Viewer appears on the screen
  • The General tab contains some basic information about the job
  • The Log Data tab contains detailed information about every object processed. The list of objects
    can be filtered.

    Note:
    The list of attributes contains a result for every attribute processed. The result is either an ADix message
    (e.g. Attribute successfully exported) or an Active Directory return code.
    In order to get a detailed description for an Active Directory return code, click the Web lookup button.

Using the Web Lookup Feature:

The Web Lookup Feature enables you to start a web lookup regarding a result message. The result string will be submitted
to a configured web search engine and the results of this search will be displayed in your internet browser.

Note:
The default search engine is set to http://search.microsoft.com/search/results.aspx?qu=. You can configure any
other search engine by setting the Web lookup string to the desired value. The web lookup string can be
configured using the ADix Default Settings/General Settings dialog.

To start a Web Lookup...

  • Select an entry from the list of attributes processed and click the Web lookup button
  • The result string will be submitted to the configured search engine and the results will be displayed in
    your internet browser.

Related Help Topics:

  • Toolbox > ADix Log File Viewer


NNS ADix - Using NNS ADix Converters

General Information:

In order to convert GUIDs, SIDs or other values into a form you can use in LDAP filters or import files, you may possibly convert
these IDs or values into a proper form. With the NNS ADix converters you can easily do this job.

Converting GUIDs:

To convert a GUID...

  • Start the ADix Converters dialog by selecting ADix Converters from the Toolbox Menu
    in the NNS ADix console tree
  • The ADix Converters dialog appears on the screen. Select the tab GUID Conversion to convert GUIDs
  • Enter either a string formatted GUID or a Hex formatted GUID and click the Convert button
  • The provided GUID will be converted and a GUID you can use in LDAP filters appears in the field
    LDAP search string compatible GUID (hex formatted). You can copy and paste this GUID
    where you need it in the LDAP filter

Converting SIDs:

To convert a SID...

  • Start the ADix Converters dialog by selecting ADix Converters from the Toolbox Menu
    in the NNS ADix console tree
  • The ADix Converters dialog appears on the screen. Select the tab SID Conversion to convert SIDs
  • Enter either a string formatted SID or a Hex formatted SID and click the Convert button
  • The provided SID will be converted and a SID you can use in LDAP filters appears in the field
    LDAP search string compatible SID (hex formatted). You can copy and paste this SID
    where you need it in the LDAP filter

Converting Logon Hours:

To convert logon hours...

  • Start the ADix Converters dialog by selecting ADix Converters from the Toolbox Menu
    in the NNS ADix console tree
  • The ADix Converters dialog appears on the screen. Select the tab Logon Hours Conversion to convert logon hours
  • Enter a Hex formatted logon hour value and click the Convert button to display the logon hours on the logon hours grid or
    set the logon hours in the logon hours grid and click the Convert button to get a Hex formatted logon hour value
  • The provided Hex formatted logon hours string can be used in import files. Further the string in the
    LDAP search string compatible logon hours (hex formatted) field can be used in LDAP filters. You can copy and
    paste these values where you need it in LDAP filters or in import files.

Converting Octet Strings:

To convert octet strings...

  • Start the ADix Converters dialog by selecting ADix Converters from the Toolbox Menu
    in the NNS ADix console tree
  • The ADix Converters dialog appears on the screen. Select the tab Octet String Conversion to convert octet strings
  • Enter a Hex formatted octet string and click the Convert button to convert the string into a format you have choosen
  • The provided Hex formatted octet string can be used in import files. Further the string in the
    LDAP search string compatible Octet String (hex formatted) field can be used in LDAP filters. You can copy and
    paste these values where you need it in LDAP filters or in import files.

Related Help Topics:

  • How to...Search for a GUID
  • How to...Search for a SID


NNS ADix - Using the AD Browser

General Information:

The NNS ADix AD Browser enables you to view the hierarchical structure of an entire Active Directory forest, tree, domain
or a branch of an AD domain.
Attributes/attribute values of an AD object can be viewed with the AD browser. Further Active Directory Tombstones
(deleted objects) can be reanimated.

Managing AD Browser Profiles:

An AD Browser Profile provides the connection settings which will be used to connect to Active Directory.
After starting NNS ADix for the first time, three AD Browser Profiles will be created per default:

  • Connection to the domain partition of the current domain (default naming context)
  • Connection to the schema partition
  • Connection to the configuration partition

Additional profiles can be created and the settings of existing profiles can be changed.

To create a new AD Browser profile...

  • Select File->Add new profile from the AD Browser main menu.
    The New AD Browser Profile dialog appears on the screen.
  • Type a name for the profile in the field Name. You can also provide a description
    in the Description field.
  • Provide the Connection Settings which are required to connect to an Active Directory Domain Controller.
    The Host specifies IP address or FQDN of the destination Domain Controller. The Base DN is the root point
    to bind to the server. The Port is the TCP/IP port used to connect to the destination server.

    Note:
    If you want to connect to the RootDSE object, provide the value RootDSE in the Base DN field.

  • Provide the credentials (username and password) which should be used when the connection to
    Active Directory will be established. If you do not specify credentials, the current credentials will be used.
  • Click the Advanced tab to specify advanced settings
  • Provide the LDAP Settings for the profile. You can specify a LDAP filter string to filter the objects returned,
    the maximum number of entries to be returned during one search request (zero will return all objects) and
    whether deleted objects should be returned or not.
  • Provide the Referral Chasing Options used for the profile.
  • Click OK to create the profile. The new profile will be displayed in the AD Browser console tree.

To edit an existing AD Browser profile...

  • Right-click on an existing profile and select Properties from the context menu.
    The AD Browser Profile Properties dialog appears on the screen.
  • Edit the profile and click OK to save the changes.

    Note:
    If you edit a profile and a connection is currently established, this connection will be disconnected.

To delete an existing AD Browser profile...

  • Right-click on an existing profile and select Delete from the context menu
  • Click Yes to confirm the deletion

To rename an existing AD Browser profile...

  • Right-click on an existing profile and select Rename from the context menu
  • Provide the new name an press Enter

Using the AD Browser:

In order to use the AD Browser, a connection to an Active Directory must be established. After the connection
is established, you can view the attributes/attribute values of the objects returned by the browser or reanimate
Active Directory tombstones.

Manage AD Browser Connections:

To connect to Active Directory...

  • Right-click on an existing profile and select Connect from the context menu
  • Provide the required credentials if necessary

    Note:
    After the connection is established, Status Bar on the bottom of the AD Browser window displays the
    connection information for the current connection.

Note:
Connections to more than one profile can be opened simultaneously.

To disconnect from Active Directory...

  • Right-click on an existing profile and select Disconnect from the context menu

View Attributes/Attribute Values:

To view attributes/attribute values...

  • Right-click on an object in the console tree and select Properties from the context menu or
    double-click on an object displayed in the details pane.
    The Object Properties dialog will be displayed.
  • Click OK to close Object Properties dialog.

Reanimate Tombstones:

To reanimate tombstones...

  • Select a tombstone (deleted object) displayed in the details pane and click the
    Reanimate Tombstone button displayed on the bottom of the details pane.
    The Reanimate Tombstone dialog will be displayed.
  • Click Start Reanimation to reanimate the selected tombstones.
  • Click Close to close the tombstone reanimation dialog.

Using Filters:

For every entry displayed in the console tree a custom LDAP filter can be applied. This feature is useful
if you want to filter a huge result.

To apply a filter...

  • Select the entry where the filter should be applied from the console tree.
  • Enter a valid LDAP Search Filter in the filter string text box.
  • Click the Apply button to apply the filter. The filtered result will be displayed in the details pane.

Note:
The filter applied for an entry will be not applied to its subentries.

To delete a filter...

  • Select the entry where the filter should be deleted from the console tree.
  • Click the Delete button to delete the filter. The new result will be displayed in the details pane.

Note:
When a filter is deleted for an entry, the filters specified for subentries will not be deleted.

Related Help Topics:

  • Toolbox > Active Directory Browser > AD Browser Profiles
  • How to...Reanimate Active Directory Tombstones
  • Appendix C: LDAP Search Filters


NNS ADix - Viewing the NNS ADix System Information

General Information:

You can view and save some basic computer and Active Directory information into
a text-based file. This information is useful for our support staff to provide fast and reliable support.

In order to view the NNS ADix system information...

  • Select Info->About NNS ADix from the Main Menu
  • Left-click the System Info button

Basic System Information is now displayed in the NNS ADix System Information dialog.

In order to save this information into a text-based file...

  • Left-click the Save to File button
  • Provide a file name and left-click the Save button

The NNS ADix system information is now saved to the text file provided. In the case of a support
call, you can send this information to our support staff.


NNS ADix - Running NNS ADix in Offline Mode

General Information:

NNS ADix can be started despite you are not connected to Active Directory. Therefore you can view log
files, edit jobs and so on.

If you start NNS ADix and a connection to Active Directory is not possible,
a warning will be reported. The current connection state will be displayed on the status bar.

Note:
Only the ADixGUI can be used in offline mode. Further if NNS ADix is started for the first time,
a connection to Active Directory must be possible.

To run NNS ADix in online mode...

  • Close NNS ADix
  • Make sure a connection to Active Directory is possible
  • Start NNS ADix

Online/Offline Mode - Feature Availability:

Feature | Online Mode | Offline Mode
Edit Default Settings | Available | Limited; browsing for a query root is disabled
Add/Edit Attribute Files | Available | Limited; the creation of new schema-based attribute files is disabled
Run the Export Wizard | Available | Not Available
Add/Edit Query Filters | Available | Limited; browsing for a query root is disabled
Add/Edit an Export Job Definition | Available | Limited; browsing for a query root is disabled
Run an Export Job | Available | Not available
Schedule an Export Job | Available | Available
Run the Import Wizard | Available | Not Available
Add/Edit an Import Job Definition | Available | Available
Run an Import Job | Available | Not available
Schedule an Import Job | Available | Available
Add/Edit Object Class Definitions | Available | Available
View Log Files | Available | Available
Use Converters | Available | Available
Use the AD Browser | Available | Limited; connecting to an AD naming context is disabled
View System Information | Available | Limited; system information for Active Directory components will not be available


NNS ADix - Running NNS ADix from the Command Line

General Information:

NNS ADix can be started from the command line (ADixCMD.exe). This feature enables NNS ADix to be used in
batch-files or in scripts. Existing AD Export or AD Import Jobs can be launched using ADixCMD.
Further ADixCMD will generate Application Event Log entries and Return Codes which you can
evaluate in your batch-files.

The ADixCMD feature is very useful for periodic data exchange with a Data Warehouse. Scheduled
AD Export/Import jobs will always be started in command line mode.

Running NNS ADix from the Command Line:

To run NNS ADix from the commend line...

  • Open a command prompt and make the ADix installation directory the current directory
  • Type ADixCMD and press Enter to display the usage of ADixCMD
  • Run ADixCMD with the desired parameters

ADixCMD Usage/Parameters:

Usage:

ADixCMD -o:<TypeOfOperation> -j:<job definition id> [-v]

Parameters:

-o:<TypeOfOperation> -> x=eXport, i=Import
-j:<job id> -> ID of the job definition to execute
-v -> verbose output (optional)

Note:
The job id can be determined using the job definition dialog in the ADixGUI.

Example:

ADixCMD -o:x -j:"3b5567f2-43ca-459f-9f36-95231e3f55a0" -v

ADixCMD Application Log Entries and Return Codes (RC):

Type | Source | Event ID | RC | Event Description | Recommended Action
Information | ADix3 | 1010 | N/A | ADixCMD environment has been successfully initialized. | No further action is required.
Error | ADix3 | 1020 | 20 | Error while starting ADixCMD. | Verify the NNS ADix installation.
Error | ADix3 | 1021 | 21 | No valid license file available. | Install a valid license file.
Error | ADix3 | 1022 | 22 | Invalid license data or eval period is over. | Install a valid license file.
Error | ADix3 | 1023 | 23 | Wrong number of parameters submitted. | A parameter is missing. Check the parameters submitted.
Error | ADix3 | 1024 | 24 | Invalid parameters submitted. | An invalid parameter was submitted. Check the parameters submitted.
Error | ADix3 | 1025 | 25 | Connection to Active Directory could not be established. | Check your network connection and make sure you can establish a connection to Active Directory
Error | ADix3 | 1026 | 26 | Registry settings could not be loaded, because ADixGUI was not started before ADixCMD for the current user account. | Before ADixCMD can be started for the current user, ADixGUI must be executed. Run ADixGUI first.
Error | ADix3 | 1027 | 27 | Some or all public items could not be set. | Some basic Active Directory parameters could not be determined. Check the connection to Active Directory.
Error | ADix3 | 1028 | 28 | Configuration file could not be verified. | The ADix configuration file is invalid. Start ADixGUI to create a new configuration file or restore a valid configuration file.
Error | ADix3 | 1029 | 29 | Job definition could not be loaded. | The given job definition does not exist in the ADix configuration file. Submit a valid job id.
Information | ADix3 | 1040 | 40 | AD Export successfully executed. | No further action is required.
Warning | ADix3 | 1041 | 41 | AD Export canceled by user interaction. | The current export job was canceled due to user interaction. No further action is required.
Error | ADix3 | 1042 | 42 | AD Export was unsuccessful. | An general error occurred during AD Export. Make sure that there is enough disk space available for writing the export file/log and you can access these files.
Information | ADix3 | 1050 | 50 | AD Import successfully executed. | No further action is required.
Warning | ADix3 | 1051 | 51 | AD Import canceled by user interaction. | The current export job was canceled due to user interaction. No further action is required.
Error | ADix3 | 1052 | 52 | AD Import was unsuccessful. | An general error occurred during AD Import. Make sure that there is enough disk space available for writing the import log. Further make sure you can access the import file.

If you periodically exchange data with a Data Warehouse and you are using a System Management Tool
(for example the System Center Operations Manager©), you can use these event log entries to monitor the status of the operation.

The error levels (return codes) can be used in batch-files or scripts to control the further program execution.

Note:
In batch-files (*.bat, *.cmd) you can evaluate the return codes using the %ERRORLEVEL% variable.
For more information about using %ERRORLEVEL% in batch-files see the Windows Help.

If you are using scripts, start ADixCMD with the WScript.Shell object using the Run method. The return value of this method
will be the error level.
For more information about the WScript.Shell object and the Run method see the Microsoft Windows Script Technologies guide.


NNS ADix - Technical Reference

Welcome to the technical reference topics!
This section provides detailed reference topics about NNS ADix. Further this section contains the User Interface (UI)
help displayed when you click the Help button in the ADix GUI.

The section contains the following topics:

  • Configuration: Describes the property pages used to configure NNS ADix
  • AD Export: Describes the property pages used for the export topics
  • AD Import: Describes the property pages used for the import topics
  • Toolbox: Describes the property pages used for the various toolbox items
  • Miscellaneous: Describes miscellaneous property pages


NNS ADix - Configuration

Use the Configuration node to configure general NNS ADix settings, to manage attribute files or to manage licenses.

The section contains the following topics:

  • ADix Default Settings: Describes the ADix Default Settings property pages
  • Attribute Files: Describes the Attribute Files dialogs and property pages
  • License Information: Describes License Information property page


NNS ADix - Configuration > ADix Default Settings

You can configure the NNS ADix default behavior via the ADix Default Configuration. The settings are saved
in the Registry on a per-user basis.

Default settings can be configured for the following areas:

  • General Settings: Provides general settings like default path settings
  • Export Settings: Default settings related to export operations
  • Import Settings: Default settings related to import operations

Related Help Topics:

  • Configuration


NNS ADix - Configuration > ADix Default Settings > General Settings

You can configure general NNS ADix configuration settings using this dialog.

The settings are saved in the Registry on a per-user basis using the following key:
HCU\Software\NNS\ADix3\General

The following tab is used for the General Settings dialog:

  • General Tab

Related Help Topics:

  • Configuration > Default Settings


NNS ADix - General Settings > General Tab

General Tab:

The General Tab contains basic default settings for NNS ADix.

This tab contains the following properties:

  • Name:
    This property is for information purposes only and cannot be changed.
  • Description:
    This property is for information purposes only and cannot be changed.

General Configuration Settings:

  • ADix configuration file:
    The ADix configuration file is used to store Query Filters, Job Definitions and Object Class Definitions. These settings
    are available for every user who uses this configuration file. We recommend to backup the ADix configuration file
    on a regularly basis.
  • Default attribute file:
    An attribute file is used in AD Export operations and helps you to select which attributes you want to export. Enter the
    complete path/filename for the default attribute file.
  • Web lookup string (used for log file details web lookup):
    This string specifies the WWW search root if you want to get more information about an error occurred during
    AD Export or AD Import. This feature is available when viewing log files using the Log File Viewer.

Path Settings:

  • Default path for attribute file:
    The default path to store or load attribute files. This path will be used by default when storing or loading attribute files.
  • Default path for Query Filter export/import:
    The default file path used when you are exporting or importing Query Filters.
  • Default path for Export Job Definition export/import:
    The default file path used when you are exporting or importing Export Job Definitions.
  • Default path for Import Job Definition export/import:
    The default file path used when you are exporting or importing import Job Definitions.

Related Help Topics:

  • Configuration > Default Settings > General Settings

Copyright © 2008 by NNS - Nigl Network Solutions/td>


NNS ADix - Configuration > ADix Default Settings > Export Settings

You can configure default settings related to AD Export using this dialog.

The settings are saved in the Registry on a per-user basis using the following key:
HCU\Software\NNS\ADix3\Export

The following tabs are used for the Export Settings dialog:

  • General Tab
  • Advanced Tab
  • Query Filter Tab
  • Attribute Syntax Conversions Tab

Related Help Topics:

  • Configuration > Default Settings


NNS ADix - Export Settings > General Tab

General Tab:

The General Tab contains basic default settings for AD Export.

This tab contains the following properties:

  • Name:
    This property is for information purposes only and cannot be changed.
  • Description:
    This property is for information purposes only and cannot be changed.

AD Export File Default Settings:

  • Default data file path for export operations:
    The default path to store export files.
  • Default export file name:
    The default name for an export file.
  • Enable Unicode encoding for export files:
    Enabling this option will create an Unicode-encoded export file. Otherwise an ANSI-encoded
    export file will be created. Enable this option, if your export data contains Unicode characters.
  • Default log file path for export operations:
    The default path to store export log files.
  • Default export log file name:
    The default name for an export log file.
  • Default field delimiter:
    The default field delimiter used in an export file to delimit the attributes.
  • Default multi-valued field delimiter:
    The default delimiter used in an export file to delimit multi-valued attributes (e.g. the group
    membership: group1|group2|group3).
  • Default text qualifier:
    The default text qualifier used to differentiate your field data from your field delimiter. The whole attribute
    value string will be enclosed by the specified text qualifier.

Related Help Topics:

  • Configuration > Default Settings > Export Settings
  • Export Settings > Advanced Tab
  • Export Settings > Query Filter Tab
  • Export Settings > Attribute Syntax Conversions Tab


NNS ADix - Export Settings > Advanced Tab

Advanced Tab:

The Advanced Tab contains advanced default settings for AD Export.

Export Operation Default Settings:

  • Export group membership using the pre-windows 2000 logon name (sAMAccountName):
    The group members/group membership will be exported using the pre-windows 2000 logon names (sAMAccountName)
    instead of the distinguished names.
  • Export the object class for each object to export (derived from 'objectClass'-hierarchy; attribute 'class'):
    Select this option if the object class should be exported.
  • Export the object path for each object to export (attribute 'path'):
    Select this option if the object path should be exported.
  • Export the objectGUID path for each object to export (attribute 'GUIDPath'):
    Select this option if the objectGUID path should be exported.
  • Enable multi-threading for this export job:
    Select this option to enable multi-threading. The export operation will be done with up to 4 threads.
    Enabling this option will decrease export time, but will put more load on the Domain Controllers.

Miscellaneous Default Settings:

  • Domain Controllers to exclude:
    Default list of excluded Domain Controllers when querying for the attribute "lastDomainLogon". Separate the
    FQDNs of the DCs by a semi-colon.

    Note:
    To avoid timeouts and delays when exporting the attribute "lastDomainLogon", enter all DCs which are not
    reachable from the computer where NNS ADix is running (e.g. a Firewall is blocking access to a DC) into this field.

Related Help Topics:

  • Configuration > Default Settings > Export Settings
  • Export Settings > General Tab
  • Export Settings > Query Filter Tab
  • Export Settings > Attribute Syntax Conversions Tab


NNS ADix - Export Settings > Query Filter Tab

Query Filter Tab:

The Query Filter Tab contains default settings related to Query Filters.

Query Filter Default Settings:

  • Default query root for new query filters:
    The default query root used when creating Query Filters. The query root represents both
    the binding context that will be used to connect to AD and the starting point for the query.

    Note:
    The query root must always start with LDAP: or GC: (use GC: to perform a Global Catalog search;
    use this moniker to search an entire forest). The monikers LDAP: and GC: are case sensitive, so always write them in capital letters!

  • Include subcontainers:
    Select the depth of search by selecting/deselecting the option Include subcontainers.
    If enabled, the query returns objects placed in the query root and in the containers below. If disabled,
    the query returns only objects placed in the query root.
  • Include deleted objects:
    Select this option if the query should also return deleted objects.
  • Specify credentials for Browse action:
    Select whether you want provide credentials (username and password) other than the current ones when browsing for
    a Query Root.

    Note:
    Enabling this option will have no impact when using the query in an export operation.

Default Referral Chasing Options:

  • None:
    Referrals will be ignored.
  • Subordinate:
    The client will chase continuation references. Continuation references occur when a subordinate naming context
    is requested. E.g. when searching the default naming context, a referral to the configuration naming context might be
    returned. If you enable this option, the configuration naming context will be displayed in the console tree.
  • External:
    The client will chase referrals in external domains. An external referral occurs when the server does not host the naming
    context, but gets a referral to another server that might host the required naming context.
    Enable this option if naming contexts not hosted by the server should be displayed in the console tree.
  • All:
    The client will chase continuation references and referrals in external domains.

Related Help Topics:

  • Configuration > Default Settings > Export Settings
  • Export Settings > General Tab
  • Export Settings > Advanced Tab
  • Export Settings > Attribute Syntax Conversions Tab


NNS ADix - Export Settings > Attribute Syntax Conversion Tab

Attribute Syntax Conversions Tab:

The Attribute Syntax Conversions Tab contains default settings related to attribute syntax conversion.
Specify for which attributes a syntax conversion should be performed.

Large Integer (int64) to Date String Conversion Settings:

  • Attributes to convert:
    Enter the names of the attributes (delimited by a semi-colon) for which a conversion should be performed.
    This setting will be used in every export operation.
    Some attribute values are stored in Active Directory using the large integer (INTEGER8) syntax. Some date/time
    values are stored using this syntax too (lastLogon, lastLogoff, pwdLastSet, ...). Therefore it will be helpfully if we can
    get the date/time representation and not only the raw large integer value.
    To get the date/time representation of the attribute value, enter all the attributes for which you want to have a large
    integer to date string conversion in this field.

    Note:
    When performing a conversion, the time zone on the client where the export operation was started will be considered.
    If a conversion fails, the raw large integer value will be used.

GUID to String Conversion Settings:

  • Attributes to convert:
    Enter the names of the attributes (delimited by a semi-colon) for which a conversion should be performed.
    This setting will be used in every export operation.
  • GUID Format:
    Select the GUID format that should be used for GUID to String conversion.

SID to String Conversion Settings:

  • Attributes to convert:
    Enter the names of the attributes (delimited by a semi-colon) for which a conversion should be performed.
    This setting will be used in every export operation.
  • SID Format:
    Select the SID format that should be used for SID to String conversion.

Octet-String to String Conversion Settings:

  • Attributes to convert:
    Enter the names of the attributes (delimited by a semi-colon) for which a conversion should be performed.
    This setting will be used in every export operation.
  • Octet-String Format:
    Select the Octet-String format that should be used for Octet-String to String conversion.

Related Help Topics:

  • Configuration > Default Settings > Export Settings
  • Export Settings > General Tab
  • Export Settings > Advanced Tab
  • Export Settings > Query Filter Tab


NNS ADix - Configuration > ADix Default Settings > Import Settings

You can configure default settings related to AD Import using this dialog.

The settings are saved in the Registry on a per-user basis using the following key:
HCU\Software\NNS\ADix3\Import

The following tabs are used for the Import Settings dialog:

  • General Tab
  • Advanced Tab
  • Attribute Syntax Conversions Tab

Related Help Topics:

  • Configuration > Default Settings


NNS ADix - Import Settings > General Tab

General Tab:

The General Tab contains basic default settings for AD Import.

This tab contains the following properties:

  • Name:
    This property is for information purposes only and cannot be changed.
  • Description:
    This property is for information purposes only and cannot be changed.

AD Import File Default Settings:

  • Default data file path for import operations:
    The default path to store import files.
  • Default import file name:
    The default name for an export file.
  • Create Test Import File:
    Creates a test import file in the default data file path.
  • Default log file path for import operations:
    The default path to store import log files.
  • Default import log file name:
    The default name for an import log file.
  • Default update key attribute:
    The default update key attribute. The update key attribute will be used as primary key when updating AD objects.
  • Default field delimiter:
    The default field delimiter used in an import file to delimit the attributes.
  • Default multi-valued field delimiter:
    The default delimiter used in an import file to delimit multi-valued attributes (e.g. the group
    membership: group1|group2|group3).
  • Default text qualifier:
    The default text qualifier used to differentiate your field data from your field delimiter. The whole attribute
    value string must be enclosed by the specified text qualifier.

Related Help Topics:

  • Configuration > Default Settings > Import Settings
  • Import Settings > Advanced Tab


NNS ADix - Import Settings > Advanced Tab

Advanced Tab:

The Advanced Tab contains advanced default settings for AD Import.

Import Operation Default Settings:

  • If object does not exist, create a new object:
    Select this option to enable the creation of new objects.
  • Enable newly created objects of type user, computer or INetOrgPerson:
    Select this option if the newly created objects of the types listed above should be enabled.
    This setting is only relevant for security principals.
  • Use the pre-Windows 2000 logon name (sAMAccountName) when updating group membership:
    The group membership will be imported using the pre-windows 2000 logon names (sAMAccountName)
    instead of using the distinguished names of the group members.
  • Clear the current group membership of an object (attribute 'memberOf') before importing
    the new group membership:
    Select this option if the group membership of the object should be replaced by the values specified in the import file.
  • Clear the current group members of an object (attribute 'member') before importing
    the new group members:
    Select this option if the group members of the object should be replaced by the values specified in the import file.
    This option is only relevant for objects of type 'group'.
  • Enable multi-threading for this import job:
    Select this option to enable multi-threading. The import operation will be done with up to 4 threads.
    Enabling this option will decrease import time, but will put more load on the Domain Controllers.

Related Help Topics:

  • Configuration > Default Settings > Import Settings
  • Import Settings > General Tab


NNS ADix - Import Settings > Attribute Syntax Conversion Tab

Attribute Syntax Conversions Tab:

The Attribute Syntax Conversions Tab contains default settings related to attribute syntax conversion.
Specify for which attributes a syntax conversion should be performed.

String to GUID Conversion Settings:

  • Attributes to convert:
    Enter the names of the attributes (delimited by a semi-colon) for which a conversion should be performed.
    This setting will be used in every import operation.

    Note:
    The following GUID formats are supported when importing GUIDs:
    - xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx (32 digits)
    - xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx (32 digits separated by hyphens)
    - {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx} (32 digits separated by hyphens, enclosed in brackets)
    - (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx) (32 digits separated by hyphens, enclosed in parentheses)
    - 0xC0 0x05 ... (16 digit groups (2 digits/group), prefixed with 0x, separated by blanks)
    - \C0\05 ... (16 digit groups (2 digits/group), separated by back slashes)
    - C0 05 ... (16 digit groups (2 digits/group), separated by blanks)
    - C005 ... (32 digits)

String to Octet-String Conversion Settings:

  • Attributes to convert:
    Enter the names of the attributes (delimited by a semi-colon) for which a conversion should be performed.
    This setting will be used in every import operation.

    Note:
    The following formats are supported when importing octet-strings:
    - 0xC0 0x05 ... (digit groups (2 digits/group), prefixed with 0x, separated by blanks)
    - \C0\05 ... (digit groups (2 digits/group), separated by back slashes)
    - C0 05 ... (digit groups (2 digits/group), separated by blanks)
    - C005 ... (an even number of digits)

Related Help Topics:

  • Configuration > Default Settings > Import Settings
  • Import Settings > General Tab
  • Import Settings > Advanced Tab


NNS ADix - Configuration > Attribute Files

Attribute files are used to store a list of Active Directory attributes. You can use this list of attributes to simplify
the attribute selection while running the AD Export Wizard or configuring an Export Job definition.

The attribute definitions are stored in an XML-file. You can configure multiple files and adjust them
to your needs.

Related Help Topics:

  • Using Attribute Files
  • Attribute File Property Page
  • New Attribute File Property Page


NNS ADix - Configuration > Attribute Files > Attribute File Property Page

Attribute File Property Page:

This dialog provides information about the Attribute File, the attributes contained in the file and
the properties of these attributes.

Note:
All changes made on an attribute file are completely independent from the Active Directory schema. Add, edit or
delete operations have only impact on the current attribute file.

This dialog contains the following properties:

  • Name:
    The logical name of the attribute file.
  • File name:
    The physical file name of the attribute file.
  • Description:
    The description of the attribute file.

List of Attributes:

The List of Attributes contains list of all attributes available for the given attribute file. In addition this list provides
the following attribute properties:

  • Attribute name (lDAPDisplayName):
    The LDAP display name (lDAPDisplayName) of the attribute.
  • Attribute Display Name:
    The display name of the attribute ("friendly" name).

    Note:
    The Active Directory schema does not provide a display name for every attribute. Therefore most of the
    display names are empty.

  • Attribute Syntax:
    The syntax of the attribute. For more information about attribute syntaxes see MSDN > ActiveDirectorySyntax Enumeration.
  • GC:
    Provides information whether this attribute is a member of the Global Catalog or not.
  • MV:
    Provides information whether this attribute is multi-valued or not.
  • SA:
    Provides information whether this attribute is a system attribute or not.

    Note:
    System attributes will be managed by the directory service only. Therefore, system attributes can't be
    updated by NNS ADix.

  • RA:
    Provides information whether this attribute replicated between Domain Controllers or not.
  • CA:
    Provides information whether this attribute a constructed attribute or not.

    Note:
    Constructed attributes are not stored in the Active Directory database but are calculated on the fly by the
    directory service. Therefore, constructed attributes can't be updated by NNS ADix. Further they can't be used
    in query filters.

  • PA:
    Provides information whether this attribute is pre-selected when when selecting attributes for export.

Related Help Topics:

  • Using Attribute Files
  • Configuration > Attribute Files
  • Attribute File Properties > Edit Attribute Properties Page


NNS ADix - Attribute File Property Page > Edit Attribute Properties Page

Edit Attribute Properties Page:

This dialog enables you to edit some properties of an attribute.

Note:
All changes made on an attribute are completely independent from the Active Directory schema.

This dialog contains the following properties:

  • Attribute name (lDAPDisplayName):
    The LDAP display name (lDAPDisplayName) of the attribute.
  • Attribute Display Name:
    The display name of the attribute ("friendly" name).

    Note:
    The Active Directory schema does not provide a display name for every attribute. Therefore most of the
    display names are empty. You can provide a custom display name here, which is completely independent from
    the Active Directory schema.

  • Description:
    The description of the attribute file.

List of Attributes:

The List of Attributes contains list of all attributes available for the given attribute file. In addition this list provides
the following attribute properties:

  • Attribute name (lDAPDisplayName):
    The LDAP display name (lDAPDisplayName) of the attribute.
  • Attribute Display Name:
    The display name of the attribute ("friendly" name).

    Note:
    The Active Directory schema does not provide a display name for every attribute. Therefore most of the
    display names are empty.

  • Attribute ID:
    The object ID (OID) for the selected attribute. If this attribute was manually added to the attribute file,
    a GUID will be displayed instead of the OID. This field is read-only.
  • Attribute Syntax:
    The syntax of the attribute. For more information about attribute syntaxes see MSDN > ActiveDirectorySyntax Enumeration.
    If this attribute was manually added to the attribute file, this property will be empty. This field is read-only.
  • GC:
    Provides information whether this attribute is a member of the Global Catalog or not. This option is read-only.
  • MV:
    Provides information whether this attribute is multi-valued or not. This option is read-only.
  • SA:
    Provides information whether this attribute is a system attribute or not. This option is read-only.

    Note:
    System attributes will be managed by the directory service only. Therefore, system attributes can't be
    updated by NNS ADix.

  • RA:
    Provides information whether this attribute replicated between Domain Controllers or not. This option is read-only.
  • CA:
    Provides information whether this attribute a constructed attribute or not. This option is read-only.

    Note:
    Constructed attributes are not stored in the Active Directory database but are calculated on the fly by the
    directory service. Therefore, constructed attributes can't be updated by NNS ADix. Further they can't be used
    in query filters.

  • PA:
    Provides information whether this attribute is pre-selected when when selecting attributes for export. You can
    pre-select an attribute by enabling this option. Attributes assigned for pre-selection will be tagged with the
    AD Export image on the left side of the attribute.

Related Help Topics:

  • Using Attribute Files
  • Configuration > Attribute Files > Attribute File Properties


NNS ADix - Configuration > Attribute Files > New Attribute File Property Page

New Attribute File Property Page:

This dialog enables you to create a new attribute file.

In order to create a new attribute file, provide the following information:

  • Name:
    The logical name of the attribute file.
  • File name:
    The physical file name of the attribute file.
  • Description:
    The description of the attribute file.

Create Attribute File Options:

  • Create a new Attribute File based on the current Active Directory Schema:
    The new attribute file will contain all attributes available from the current Active Directory Schema.
  • Create a new empty Attribute File:
    A new empty attribute file will be created.

Related Help Topics:

  • Using Attribute Files
  • Configuration > Attribute Files
  • Attribute File Properties > Edit Attribute Properties Page


NNS ADix - Configuration > License Information

General Information:

You can manage licenses using the NNS ADix License Information. This area provides information
about all installed license files and enables you to delete or add licenses.

To install a license file...

  • Right-click the License Information pane and select Install a license from
    the context menu. The Install License File dialog appears on the screen.
  • Select the license file you want to install and click Open. If the license file was valid,
    the new license file will appear in the list of licenses.

To delete a license file...

  • Right-click the license file you want to delete and select Delete from the context menu.
    Confirm the deletion by clicking Yes on the Delete License confirmation dialog.

To view detailed license information for a license file...

  • Right-click the license file for which you want to display detailed information and select Properties
    from the context menu. The License Property dialog appears on the screen.
  • Click OK to close the License Property dialog.

Detailed license information can be viewed by opening the properties of a license file:

  • License Property Page: Provides detailed license information for the selected license file

Related Help Topics:

  • End-User License Agreement (EULA)


NNS ADix - Configuration > License Information > License Property Page

License Property Page:

Use the License Property Page to view detailed license information.

This dialog contains the following properties:

  • File name:
    The physical file name of the license file.
  • License state:
    The current license state of the license file. The license state provides information whether a
    license is valid or not. Further this property will show the days left to trial for a trial license file.

License File Data:

  • Product:
    The product for which the license was issued.
  • Product version:
    The product version for which the license was issued.
  • License type:
    The type of the license. Possible values are
    - TRIAL (Trial License)
    - SL (Single License)
    - LP5 (License Pack 5)
    - LP10 (License Pack 10)
    - EL (Enterprise License)

License Information:

  • Name:
    The name of the licensee.
  • Company:
    The company name of the licensee.
  • E-Mail:
    The e-mail address of the licensee.

Related Help Topics:

  • Configuration > License Information


NNS ADix - AD Export

Use the AD Export node to launch the Export Wizard or to manage Query Filters, Export Job Definitions or Scheduled Export Jobs.

The section contains the following topics:

  • Export Wizard: Describes the Export Wizard property pages
  • Query Filters: Describes the Query Filter dialogs and property pages
  • Export Job Definitions: Describes the Export Job Definition dialogs and property pages
  • Scheduled Export Jobs: Describes the Scheduled Export Jobs tab
  • Export Processing Logic: Contains a comprehensive description of the AD Export process


NNS ADix - AD Export > Export Wizard

The AD Export Wizard guides you through the process of exporting Active Directory objects into a text-based file.

The Export Wizard consists of the following property pages:

  • Select Query Filter Property Page
  • Set Referral Chasing Option Property Page
  • Select Attributes Property Page
  • Set Export Operation Settings Property Page
  • Set Export File Settings Property Page
  • Review Task Summary Property Page

Related Help Topics:

  • Exporting AD Objects


NNS ADix - AD Export > Export Wizard > Select Query Filter Property Page

Query Filter Settings:

  • Query root:
    The query root represents both the binding context that will be used to connect to AD and the starting point for the query.

    Note:
    The query root must always start with LDAP: or GC: (use GC: to perform a Global Catalog search;
    use this moniker to search an entire forest). The monikers LDAP: and GC: are case sensitive, so always write them in capital letters!

  • Include Subcontainers:
    Select the depth of search by selecting/deselecting the option Include subcontainers.
    If enabled, the query returns objects placed in the query root and in the containers below. If disabled,
    the query returns only objects placed in the query root.
  • Include deleted objects:
    Select this option if the query should also return deleted objects.
  • Browse: Ask for credentials:
    Select whether you want provide credentials (username and password) other than the current ones when browsing for
    a Query Root.

    Note:
    Enabling this option will have no impact when using the query in an export operation.

  • Query Filter string:
    Add the filter conditions which should be used for the query.

    Note:
    NNS ADix v3 only supports LDAP search filters. For more information about LDAP search filters see
    Appendix C: LDAP Search Filters.

  • Select a Query Filter button:
    Click this button to select a Query Filter from the query filter repository. Selecting a Query Filter from this repository
    will overwrite the settings already made.

Related Help Topics:

  • AD Export > Export Wizard > Set Referral Chasing Option Property Page
  • AD Export > Export Wizard > Select Attributes Property Page
  • AD Export > Export Wizard > Set Export Operation Settings Property Page
  • AD Export > Export Wizard > Set Export File Settings Property Page
  • AD Export > Export Wizard > Review Task Summary Property Page


NNS ADix - AD Export > Export Wizard > Set Referral Chasing Option Property Page

Referral Chasing Options:

  • None:
    Referrals will be ignored.
  • Subordinate:
    The client will chase continuation references. Continuation references occur when a subordinate naming context
    is requested. E.g. when searching the default naming context, a referral to the configuration naming context might be
    returned. If you enable this option, the configuration naming context will be displayed in the console tree.
  • External:
    The client will chase referrals in external domains. An external referral occurs when the server does not host the naming
    context, but gets a referral to another server that might host the required naming context.
    Enable this option if naming contexts not hosted by the server should be displayed in the console tree.
  • All:
    The client will chase continuation references and referrals in external domains.

Note:
We do dot recommend to enable referral chasing to retrieve objects from the whole Active Directory Forest. Instead
perform a query using the Global Catalog (GC) to get objects from the whole AD Forest.

Related Help Topics:

  • AD Export > Export Wizard > Select Query Filter Property Page
  • AD Export > Export Wizard > Select Attributes Property Page
  • AD Export > Export Wizard > Set Export Operation Settings Property Page
  • AD Export > Export Wizard > Set Export File Settings Property Page
  • AD Export > Export Wizard > Review Task Summary Property Page


NNS ADix - AD Export > Export Wizard > Select Attributes Property Page

Attribute Settings:

  • Attributes:
    Enter the LDAP display names (lDAPDisplayName) of the attributes you want to export. Separate the
    attributes with a semi-colon.
  • Select Attributes to Export button:
    Click this button to select the attributes you want to export from the default attribute file.

Related Help Topics:

  • AD Export > Export Wizard > Select Query Filter Property Page
  • AD Export > Export Wizard > Set Referral Chasing Option Property Page
  • AD Export > Export Wizard > Set Export Operation Settings Property Page
  • AD Export > Export Wizard > Set Export File Settings Property Page
  • AD Export > Export Wizard > Review Task Summary Property Page


NNS ADix - AD Export > Export Wizard > Set Export Operation Settings Property Page

Export Operation Settings:

  • Export group membership using the pre-windows 2000 logon name (sAMAccountName):
    The group members/group membership will be exported using the pre-windows 2000 logon names (sAMAccountName)
    instead of the distinguished names.
  • Export the object class for each object to export (derived from 'objectClass'-hierarchy; attribute 'class'):
    Select this option if the object class should be exported.
  • Export the object path for each object to export (attribute 'path'):
    Select this option if the object path should be exported.
  • Export the objectGUID path for each object to export (attribute 'GUIDPath'):
    Select this option if the objectGUID path should be exported.
  • Enable multi-threading for this export job:
    Select this option to enable multi-threading. The export operation will be done with up to 4 threads.
    Enabling this option will decrease export time, but will put more load on the Domain Controllers.

Related Help Topics:

  • AD Export > Export Wizard > Select Query Filter Property Page
  • AD Export > Export Wizard > Set Referral Chasing Option Property Page
  • AD Export > Export Wizard > Select Attributes Property Page
  • AD Export > Export Wizard > Set Export File Settings Property Page
  • AD Export > Export Wizard > Review Task Summary Property Page


NNS ADix - AD Export > Export Wizard > Set Export File Settings Property Page

Export File Settings:

  • Export file name:
    The path and file name of the export file that should be used during the export operation.
  • Export log file name:
    The path and file name of the export log file that will be produced by the export operation. Any existing files will be overwritten.
  • Field delimiter:
    The field delimiter used in an export file to delimit the attributes.
  • Multi-valued field delimiter:
    The delimiter used in an export file to delimit multi-valued attributes (e.g. the group
    membership: group1|group2|group3).
  • Text qualifier:
    The text qualifier used to differentiate your field data from your field delimiter. The whole attribute
    value string will be enclosed by the specified text qualifier.

Related Help Topics:

  • AD Export > Export Wizard > Select Query Filter Property Page
  • AD Export > Export Wizard > Set Referral Chasing Option Property Page
  • AD Export > Export Wizard > Select Attributes Property Page
  • AD Export > Export Wizard > Set Export Operation Settings Property Page
  • AD Export > Export Wizard > Review Task Summary Property Page


NNS ADix - AD Export > Export Wizard > Review Task Summary Property Page

Review Task Summary:

  • Start Export Button:
    Click this button to start the export operation.
  • Save Settings Button:
    Click this button to save the current export settings into an export job definition.

Related Help Topics:

  • AD Export > Export Wizard > Select Query Filter Property Page
  • AD Export > Export Wizard > Set Referral Chasing Option Property Page
  • AD Export > Export Wizard > Select Attributes Property Page
  • AD Export > Export Wizard > Set Export Operation Settings Property Page
  • AD Export > Export Wizard > Set Export File Settings Property Page
  • Review Task Summary Property Page > Save Import Settings Property Page


NNS ADix - Review Task Summary Property Page > Save Export Settings

General Tab:

  • Name:
    The name of the export job to save.
  • Description:
    The description of the export job to save.

Related Help Topics:

  • Using Job Definitions
  • AD Export > Export Job Definitions
  • AD Export > Export Wizard > Review Task Summary Property Page


NNS ADix - AD Export > Query Filters

Query Filters are used to find Active Directory objects based on selection criteria (query). Query Filters
are primarily used in export operations.

The following property pages are available for query filters:

  • Query Filter Property Page: Describes the query filter dialog
  • Edit Query Property Page: Describes the edit query dialog
  • Query Filter Preview Property Page: Describes the query filter preview dialog

Related Help Topics:

  • Using Query Filters


NNS ADix - AD Export > Query Filters > Query Filter Properties

The following tabs are used for the Query Filter properties dialog:

  • General Tab: Contains basic settings for the Query Filter
  • Advanced Tab: Contains advanced settings for the Query Filter

Related Help Topics:

  • AD Export > Query Filters


NNS ADix - Query Filter Properties > General Tab

General Tab:

The General Tab contains basic settings for the Query Filter.

This tab contains the following properties:

  • Name:
    The name of the query filter. This name must be unique within a container.
  • Description:
    The description for the query filter.

Query Filter Settings:

  • Query root:
    The query root represents both the binding context that will be used to connect to AD and the starting point for the query.

    Note:
    The query root must always start with LDAP: or GC: (use GC: to perform a Global Catalog search;
    use this moniker to search an entire forest). The monikers LDAP: and GC: are case sensitive, so always write them in capital letters!

  • Include Subcontainers:
    Select the depth of search by selecting/deselecting the option Include subcontainers.
    If enabled, the query returns objects placed in the query root and in the containers below. If disabled,
    the query returns only objects placed in the query root.
  • Include deleted objects:
    Select this option if the query should also return deleted objects.
  • Browse/Preview: Ask for credentials:
    Select whether you want provide credentials (username and password) other than the current ones when browsing for
    a Query Root or when previewing the query filter.

    Note:
    Enabling this option will have no impact when using the query in an export operation.

  • Query Filter string:
    Add the filter conditions which should be used for the query.

    Note:
    NNS ADix v3 only supports LDAP search filters. For more information about LDAP search filters see
    Appendix C: LDAP Search Filters.

  • Edit Query button:
    Click this button to start the Edit Query dialog.
  • Preview button:
    Click this button to get a preview of the query result.

Related Help Topics:

  • Query Filter Properties > Advanced Tab
  • AD Export > Edit Query Properties
  • AD Export > Query Filter Preview Properties


NNS ADix - Query Filter Properties > Advanced Tab

Advanced Tab:

The Advanced Tab contains advanced settings for the Query Filter.

This tab contains the following properties:

Referral Chasing Options:

  • None:
    Referrals will be ignored.
  • Subordinate:
    The client will chase continuation references. Continuation references occur when a subordinate naming context
    is requested. E.g. when searching the default naming context, a referral to the configuration naming context might be
    returned. If you enable this option, the configuration naming context will be displayed in the console tree.

    Note:
    If you enable this option, paged searches are disabled. This means that only the first 1.000 objects will be returned
    by the query (1.000 is the default value for the maximum page size configured in the Active Directory default LDAP Policy.
    See the following Microsoft article for more information: How to view and set LDAP policy in Active Directory by using Ntdsutil.exe).

  • External:
    The client will chase referrals in external domains. An external referral occurs when the server does not host the naming
    context, but gets a referral to another server that might host the required naming context.
    Enable this option if naming contexts not hosted by the server should be displayed in the console tree.
  • All:
    The client will chase continuation references and referrals in external domains.

    Note:
    The "Subordinate" option is included in the "All" option, so paged searches are disabled if you enable this option.

Note:
We do not recommend to enable referral chasing to retrieve objects from the whole Active Directory Forest. Instead
perform a query using the Global Catalog (GC) to get objects from the whole AD Forest.

Related Help Topics:

  • Query Filter Properties > General Tab


NNS ADix - AD Export > Query Filters > Edit Query Properties

The following tabs are used for the Edit Query properties dialog:

  • Custom Search Tab: Enables you to specify a query filter using predefined attributes and operators
  • Advanced Tab: Enables you to enter a query string based on the LDAP syntax

Related Help Topics:

  • AD Export > Query Filters


NNS ADix - Edit Query Properties > Custom Search Tab

Custom Search Tab:

The Custom Search Tab enables you to specify a query filter using predefined attributes and operators.

This tab contains the following properties:

  • Field button:
    Select the attributes you want to include in your query from the context menu. This menu displays the Attribute
    Display Names (attributeDisplayNames) and the LDAP Display Names (lDAPDisplayName). Only the lDAPDisplayName
    will be used in the condition list.
  • Condition:
    Select the condition you want to use from the list of conditions. If you want to use multi-valued attributes in your
    query (e.g. 'memberOf'), only the conditions 'Is (exactly)', 'Is not', 'present' and 'Not present' will return any objects.
    Further this avoids the use of wildcards.
  • Value:
    Type the value you want to use for the selected condition.
  • Condition List:
    This list displays the search criteria you have specified using Field, Condition and Value. You can add or remove
    search criteria to narrow widen your search. Multiple conditions are always 'AND-ed'.

Related Help Topics:

  • Edit Query Properties > Advanced Tab
  • Appendix C: LDAP Search Filters


NNS ADix - Edit Query Properties > Advanced Tab

Advanced Tab:

The Advanced Tab enables you to enter a query string based on the LDAP syntax.

This tab contains the following properties:

  • Enter LDAP Query:
    The filter conditions that will be used in the query. Only the LDAP dialect is valid.

Related Help Topics:

  • Edit Query Properties > General Tab
  • Appendix C: LDAP Search Filters


NNS ADix - AD Export > Query Filters > Query Filter Preview Properties

General Information:

This dialog contains the results of the selected Query Filter.

This dialog enables you to...
- View the attributes/attribute values of the objects returned by the query
- Reanimate Active Directory tombstones

General Tab:

This tab contains the following properties:

  • Query root:
    The query root used by the query filter.
  • Query string:
    The LDAP query string used by the query filter.
  • Include subcontainers:
    Displays the search depth used by the query filter.
  • Include deleted objects:
    Displays whether deleted objects are included in the query filter.
  • Referral Chasing:
    Displays the referral chasing option selected for the query filter.
  • User ID:
    Displays the user ID which was used when executing the query.

Query Filter Result:

The Query Filter Result contains a list of all objects returned by the query filter. In addition this list provides
the following attribute properties:

  • Name:
    The common name (cn) of the object.
  • Object Class:
    The name of the object class.
  • Distinguished Name:
    The distinguished name (distinguishedName) of the object.
  • Properties button:
    Click this button to view the properties (attribute values) of the selected object.
  • Reanimate the selected tombstone(s) button:
    Click this button to launch the tombstone reanimation dialog.

Related Help Topics:

  • Using Query Filters
  • How to...Reanimate Active Directory Tombstones
  • AD Export > Query Filters > Query Filter Properties


NNS ADix - AD Export > Export Job Definitions

Export Job Definitions are used to save export settings which should be used in an export operation. These jobs can be started
either by using the ADix GUI or by running NNS ADix from the command line.

Further the jobs can be scheduled to run at specific times or can be used in batch-files/scripts.

The following property pages are available for export job definitions:

  • Export Job Definition Property Page: Describes the export job definition dialog
  • Create Export Job Property Page: Describes the create export job dialog

Related Help Topics:

  • Using Job Definitions
  • Scheduling Jobs
  • Running NNS ADix from the Command Line


NNS ADix - AD Export > Export Job Definitions > Export Job Definition Properties

The following tabs are used for the Export Job Definition properties dialog:

  • General Tab: Contains basic settings for the Export Job Definition
  • Filter Tab: Enables you to set query filter settings
  • Attributes Tab: Enables you to set the attributes you want to export

Related Help Topics:

  • AD Export > Export Job Definitions


NNS ADix - Export Job Definition Properties > General Tab

General Tab:

The General Tab contains basic settings for the Export Job Definition.

This tab contains the following properties:

  • Name:
    The name of the export job definition. This name must be unique within a container.
  • ID:
    The ID of the export job definition. This ID will be managed by NNS ADix and is used to identify the job.
  • Description:
    The description for the export job definition.

Export File Settings:

  • Export file name:
    The path and file name of the export file that should be used for the export operation.
  • Export log file name:
    The path and file name of the export log file that will be produced by the export operation. Any existing files will be overwritten.
  • Field delimiter:
    The field delimiter used in an export file to delimit the attributes.
  • Multi-valued field delimiter:
    The delimiter used in an export file to delimit multi-valued attributes (e.g. the group
    membership: group1|group2|group3).
  • Text qualifier:
    The text qualifier used to differentiate your field data from your field delimiter. The whole attribute
    value string will be enclosed by the specified text qualifier.

Export Operation Settings:

  • Export group membership using the pre-windows 2000 logon name (sAMAccountName):
    The group members/group membership will be exported using the pre-windows 2000 logon names (sAMAccountName)
    instead of the distinguished names.
  • Export the object class for each object to export (derived from 'objectClass'-hierarchy; attribute 'class'):
    Select this option if the object class should be exported.
  • Export the object path for each object to export (attribute 'path'):
    Select this option if the object path should be exported.
  • Export the objectGUID path for each object to export (attribute 'GUIDPath'):
    Select this option if the objectGUID path should be exported.
  • Enable multi-threading for this export job:
    Select this option to enable multi-threading. The export operation will be done with up to 4 threads.
    Enabling this option will decrease export time, but will put more load on the Domain Controllers.

Related Help Topics:

  • Export Job Definition Properties > Filter Tab
  • Export Job Definition Properties > Attributes Tab


NNS ADix - Export Job Definition Properties > Filter Tab

Filter Tab:

The Filter Tab contains the filter settings for the Export Job Definition.

This tab contains the following properties:

Query Filter Settings:

  • Query root:
    The query root represents both the binding context that will be used to connect to AD and the starting point for the query.

    Note:
    The query root must always start with LDAP: or GC: (use GC: to perform a Global Catalog search;
    use this moniker to search an entire forest). The monikers LDAP: and GC: are case sensitive, so always write them in capital letters!

  • Include Subcontainers:
    Select the depth of search by selecting/deselecting the option Include subcontainers.
    If enabled, the query returns objects placed in the query root and in the containers below. If disabled,
    the query returns only objects placed in the query root.
  • Include deleted objects:
    Select this option if the query should also return deleted objects.
  • Browse/Preview: Ask for credentials:
    Select whether you want provide credentials (username and password) other than the current ones when browsing for
    a Query Root or when previewing the query filter.

    Note:
    Enabling this option will have no impact when using the query in an export operation.

  • Query Filter string:
    Add the filter conditions which should be used for the query.

    Note:
    NNS ADix v3 only supports LDAP search filters. For more information about LDAP search filters see
    Appendix C: LDAP Search Filters.

  • Edit Query button:
    Click this button to start the Edit Query dialog.
  • Preview button:
    Click this button to get a preview of the query result.
  • Select a Query Filter button:
    Click this button to select a Query Filter from the query filter repository. Selecting a Query Filter from this repository
    will overwrite the settings already made.

Referral Chasing Options:

  • None:
    Referrals will be ignored.
  • Subordinate:
    The client will chase continuation references. Continuation references occur when a subordinate naming context
    is requested. E.g. when searching the default naming context, a referral to the configuration naming context might be
    returned. If you enable this option, the configuration naming context will be displayed in the console tree.
  • External:
    The client will chase referrals in external domains. An external referral occurs when the server does not host the naming
    context, but gets a referral to another server that might host the required naming context.
    Enable this option if naming contexts not hosted by the server should be displayed in the console tree.
  • All:
    The client will chase continuation references and referrals in external domains.

Note:
We do dot recommend to enable referral chasing to retrieve objects from the whole Active Directory Forest. Instead
perform a query using the Global Catalog (GC) to get objects from the whole AD Forest.

Related Help Topics:

  • Export Job Definition Properties > General Tab
  • Export Job Definition Properties > Attributes Tab
  • AD Export > Edit Query Properties
  • AD Export > Query Filter Preview Properties


NNS ADix - Export Job Definition Properties > Attributes Tab

Attributes Tab:

The Attributes Tab contains a list of attributes you wanto to use for this Export Job Definition.

This tab contains the following properties:

Attribute Settings:

  • Attributes:
    Enter the LDAP display names (lDAPDisplayName) of the attributes you want to export. Separate the
    attributes with a semi-colon.
  • Select Attributes to Export button:
    Click this button to select the attributes you want to export from the default attribute file.

Related Help Topics:

  • Export Job Definition Properties > General Tab
  • Export Job Definition Properties > Filter Tab


NNS ADix - AD Export > Export Job Definitions > Create Export Job Properties

The following tabs are used for the Export Job properties dialog:

  • General Tab: Contains basic settings for the Export Job

Related Help Topics:

  • Scheduling Jobs
  • Running NNS ADix from the Command Line
  • AD Export > Export Job Definitions


NNS ADix - Create Export Job Properties > General Tab

General Tab:

The General Tab contains basic settings for the Export Job.

This tab contains the following properties:

  • Job Name:
    The name of the export job. This name must be unique.

    Note:
    Every export job created with the ADix GUI is automatically prefixed with "[ADix3 Export Job]".
    The prefix ensures that only ADix jobs are displayed in the ADix GUI. We recommend to not change this prefix
    in the Windows Task Scheduler.

  • Description:
    The description for the export job.

Job Credentials:

  • User name:
    The username which will be used when the job runs.
  • Password:
    The appropriate password for the given username.

Related Help Topics:

  • AD Export > Export Job Definitions > Create Import Job Properties


NNS ADix - AD Export > Scheduled Export Jobs

This tab contains a list of scheduled export jobs. You can edit or delete these jobs.

Related Help Topics:

  • Scheduling Jobs
  • Running NNS ADix from the Command Line
  • AD Export > Export Job Definitions


NNS ADix - AD Export > Export Processing Logic

This topic contains a comprehensive description of the AD Export process. The information provided in this topic
helps you to understand how Active Directory objects are exported from Active Directory into a text-based file.

AD Export - Process Steps:

The AD Export process consists of the following steps:

  • Step I: Create Export Log
    The export log file will be created in this step. If this step fails, the entire AD Export operation
    will be stopped and the status of the operation is 'Failed'. The process continues with step VII.
  • Step II: Create Export File
    The export file will be created in this step. If this step fails, the entire AD Export operation
    will be stopped and the status of the operation is 'Failed'. The process continues with step V.
  • Step III: Execute the Query
    The query will be executed. The data returned by the query will be temporarily saved in a dataset.
    If this step fails, the entire AD Export operation will be stopped and the status of the operation
    is 'Failed'. The process will continue with step V. If the query returns no objects, the status of the
    operation is 'Success'. The export process continues with step V.
  • Step IV: Export Active Directory Objects
    The dataset returned by the query will be parsed row by row and the data rows will be written to the export
    file. This step consists of the following sub steps:
    • Step IVa: Get the Active Directory object to export
      An attempt to access the object to export will be made. If this step fails, an error will be logged
      and the export process continues with step IV using the next data row.
    • Step IVb: Get the object class (optional)
      An attempt to export the object class will be made. If this step fails, an error will be logged
      and the export process continues with step IVc. This step will be executed, if the export setting
      'Export the object class for each object to export (derived from 'objectClass'-hierarchy; attribute 'class')' is
      enabled. Otherwise, this step will be skipped.
    • Step IVc: Get the object path (optional)
      An attempt to export the object path will be made. This step will be executed, if the export setting
      'Export the object path for each object to export (attribute 'path')' is enabled. Otherwise, this step will be skipped.
    • Step IVd: Get the object GUID path (optional)
      An attempt to export the object GUID path will be made. If this step fails, an error will be logged
      and the export process continues with step IVe. This step will be executed, if the export setting
      'Export the object objectGUID path for each object to export (attribute 'GUIDPath')' is enabled. Otherwise,
      this step will be skipped.
    • Step IVe: Export the attributes
      The attributes selected for the export operation are exported in this step. Every attribute will be
      parsed separately from each other. If one attribute fails (no permission, the attribute is empty, ...),
      an error will be logged and the export process continues with step IVe (the next attribute will be
      exported).
    • Step IVf: Check, if the export operation should be Canceled
      If the user cancels the operation (Cancel-button), the operation continues with step V. Otherwise,
      step IV will be the next step (the next object will be exported).
  • Step V: Generate Export Statistics
    The export statistics will be created in this step.
  • Step VI: Finalize Export Log File
    The export log file will be finalized in this step.
  • Step VII: End Export Process
    The AD Export operation has finished at this point.

AD Export - Process Flowchart:


NNS ADix - AD Import

Use the AD Import node to launch the Import Wizard or to manage Import Job Definitions, Scheduled Import Jobs or Object Class Definitions.

The section contains the following topics:

  • Import Wizard: Describes the Import Wizard property pages
  • Import Job Definitions: Describes the Import Job Definition dialogs and property pages
  • Scheduled Import Jobs: Describes the Scheduled Import Jobs tab
  • Object Class Definitions: Describes the Object Class Definition dialogs and property pages
  • Import Processing Logic: Contains a comprehensive description of the AD Import process


NNS ADix - AD Import > Import Wizard

The AD Import Wizard guides you through the process of importing Active Directory objects from a text-based file.

The Import Wizard consists of the following property pages:

  • Set Import File Settings Property Page
  • Set Import Operation Settings Property Page
  • Review Task Summary Property Page

Related Help Topics:

  • Importing AD Objects


NNS ADix - AD Import > Import Wizard > Set Import File Settings Property Page

Import File Settings:

  • Import file name:
    The path and file name of the import file that should be used during the import operation.
  • Import log file name:
    The path and file name of the import log file that will be produced by the import operation. Any existing files will be overwritten.
  • Field delimiter:
    The field delimiter used in an import file to delimit the attributes.
  • Multi-valued field delimiter:
    The delimiter used in an import file to delimit multi-valued attributes (e.g. the group
    membership: group1|group2|group3).
  • Text qualifier:
    The text qualifier used to differentiate your field data from your field delimiter. The whole attribute
    value string must be enclosed by the specified text qualifier.

Attributes to Import:

  • Update key attribute:
    The update key attribute will be used as primary key when updating AD objects.
    This attribute must be present in the import file and will be used to identify existing objects.
  • List of Attributes to import:
    This list contains all attributes defined for import in the import file (derived from the import file header).
  • Validate Import File Button:
    Click this button to validate the structure of the import file. In order to import data from the given import
    file, the structure of the import file must be valid.

Related Help Topics:

  • AD Import > Import Wizard > Set Import Operation Settings Property Page
  • AD Import > Import Wizard > Review Task Summary Property Page


NNS ADix - AD Import > Import Wizard > Set Import Operation Settings Property Page

Import Operation Settings:

  • If object does not exist, create a new object:
    Select this option to enable the creation of new objects.
  • Enable newly created objects of type user, computer or INetOrgPerson:
    Select this option if the newly created objects of the types listed above should be enabled.
    This setting is only relevant for security principals.
  • Use the pre-Windows 2000 logon name (sAMAccountName) when updating group membership:
    The group membership will be imported using the pre-windows 2000 logon names (sAMAccountName)
    instead of using the distinguished names of the group members.
  • Clear the current group membership of an object (attribute 'memberOf') before importing
    the new group membership:
    Select this option if the group membership of the object should be replaced by the values specified in the import file.
  • Clear the current group members of an object (attribute 'member') before importing
    the new group members:
    Select this option if the group members of the object should be replaced by the values specified in the import file.
    This option is only relevant for objects of type 'group'.
  • Enable multi-threading for this import job:
    Select this option to enable multi-threading. The import operation will be done with up to 4 threads.
    Enabling this option will decrease import time, but will put more load on the Domain Controllers.

Related Help Topics:

  • AD Import > Import Wizard > Set Import File Settings Property Page
  • AD Import > Import Wizard > Review Task Summary Property Page


NNS ADix - AD Import > Import Wizard > Review Task Summary Property Page

Review Task Summary:

  • Start Import Button:
    Click this button to start the import operation.
  • Save Settings Button:
    Click this button to save the current import settings into an import job definition.

Related Help Topics:

  • AD Import > Import Wizard > Set Import File Settings Property Page
  • AD Import > Import Wizard > Import Job Settings Property Page
  • Review Task Summary Property Page > Save Import Settings Property Page


NNS ADix - Review Task Summary Property Page > Save Import Settings

General Tab:

  • Name:
    The name of the import job to save.
  • Description:
    The description of the import job to save.

Related Help Topics:

  • Using Job Definitions
  • AD Import > Import Job Definitions
  • AD Import > Import Wizard > Review Task Summary Property Page


NNS ADix - AD Import > Import Job Definitions

Import Job Definitions are used to save import settings which should be used in an import operation. These jobs can be started
either by using the ADix GUI or by running NNS ADix from the command line.

Further the jobs can be scheduled to run at specific times or can be used in batch-files/scripts.

The following property pages are available for import job definitions:

  • Import Job Definition Property Page: Describes the import job definition dialog
  • Create Import Job Property Page: Describes the create import job dialog

Related Help Topics:

  • Using Job Definitions
  • Scheduling Jobs
  • Running NNS ADix from the Command Line


NNS ADix - AD Import > Import Job Definitions > Import Job Definition Properties

The following tabs are used for the Import Job Definition properties dialog:

  • General Tab: Contains basic settings for the Import Job Definition
  • Advanced Tab: Enables you to set advanced settings

Related Help Topics:

  • AD Import > Import Job Definitions


NNS ADix - Import Job Definition Properties > General Tab

General Tab:

The General Tab contains basic settings for the Import Job Definition.

This tab contains the following properties:

  • Name:
    The name of the import job definition. This name must be unique.
  • ID:
    The ID of the import job definition. This ID will be managed by NNS ADix and is used to identify the job.
  • Description:
    The description for the import job definition.

Import File Settings:

  • Import file name:
    The path and file name of the import file that should be used during the import operation.
  • Import log file name:
    The path and file name of the import log file that will be produced by the import operation. Any existing files will be overwritten.
  • Field delimiter:
    The field delimiter used in an import file to delimit the attributes.
  • Multi-valued field delimiter:
    The delimiter used in an import file to delimit multi-valued attributes (e.g. the group
    membership: group1|group2|group3).
  • Text qualifier:
    The text qualifier used to differentiate your field data from your field delimiter. The whole attribute
    value string must be enclosed by the specified text qualifier.

Attributes to Import:

  • Update key attribute:
    The update key attribute will be used as primary key when updating AD objects.
    This attribute must be present in the import file and will be used to identify existing objects.
  • List of Attributes to import:
    This list contains all attributes defined for import in the import file (derived from the import file header).
  • Validate Import File Button:
    Click this button to validate the structure of the import file. In order to import data from the given import
    file, the structure of the import file must be valid.

Related Help Topics:

  • Import Job Definition Properties > Advanced Tab


NNS ADix - Import Job Definition Properties > Advanced Tab

Advanced Tab:

The Advanced Tab contains advanced settings for the Import Job Definition.

This tab contains the following properties:

Import Operation Settings:

  • If object does not exist, create a new object:
    Select this option to enable the creation of new objects.
  • Enable newly created objects of type user, computer or INetOrgPerson:
    Select this option if the newly created objects of the types listed above should be enabled.
    This setting is only relevant for security principals.
  • Use the pre-Windows 2000 logon name (sAMAccountName) when updating group membership:
    The group membership will be imported using the pre-windows 2000 logon names (sAMAccountName)
    instead of using the distinguished names of the group members.
  • Clear the current group membership of an object (attribute 'memberOf') before importing
    the new group membership:
    Select this option if the group membership of the object should be replaced by the values specified in the import file.
  • Clear the current group members of an object (attribute 'member') before importing
    the new group members:
    Select this option if the group members of the object should be replaced by the values specified in the import file.
    This option is only relevant for objects of type 'group'.
  • Enable multi-threading for this import job:
    Select this option to enable multi-threading. The import operation will be done with up to 4 threads.
    Enabling this option will decrease import time, but will put more load on the Domain Controllers.

Related Help Topics:

  • Import Job Definition Properties > General Tab


NNS ADix - AD Import > Import Job Definitions > Create Import Job Properties

The following tabs are used for the Import Job properties dialog:

  • General Tab: Contains basic settings for the Import Job

Related Help Topics:

  • Scheduling Jobs
  • Running NNS ADix from the Command Line
  • AD Import > Import Job Definitions


NNS ADix - Create Import Job Properties > General Tab

General Tab:

The General Tab contains basic settings for the Import Job.

This tab contains the following properties:

  • Job Name:
    The name of the import job. This name must be unique.

    Note:
    Every import job created with the ADix GUI is automatically prefixed with "[ADix3 Import Job]".
    The prefix ensures that only ADix jobs are displayed in the ADix GUI. We recommend to not change this prefix
    in the Windows Task Scheduler.

  • Description:
    The description for the import job.

Job Credentials:

  • User name:
    The username which will be used when the job runs.
  • Password:
    The appropriate password for the given username.

Related Help Topics:

  • AD Import > Import Job Definitions > Create Import Job Properties


NNS ADix - AD Import > Scheduled Import Jobs

This tab contains a list of scheduled import jobs. You can edit or delete these jobs.

Related Help Topics:

  • Scheduling Jobs
  • Running NNS ADix from the Command Line
  • AD Import > Import Job Definitions


NNS ADix - AD Import > Object Class Definitions

An object class definition provides information which attributes are mandatory for an object class.

An object class definition is necessary for every object class you want to create an object.
E.g. you want to create an object of class "user", there must be a corresponding object class available.

NNS ADix provides some basic object class definitions. You can add new ones or edit existing object class
definitions.

Note:
The mandatory attributes set in an object class definition are independent from the mandatory attributes
defined in the Active Directory Schema. However, an object class definition must contain at least the
mandatory attributes dictated by the schema.

A Object Class Definition can be managed using the following property page:

  • Object Class Definition Property Page: Enables you to manage the properties of an object class definition

Related Help Topics:

  • Using Object Class Definitions
  • Appendix D: Object Classes and Mandatory Attributes


NNS ADix - AD Import > Object Class Definitions > Object Class Definition Property Page

General Tab:

The General Tab contains basic settings for the Import Job.

This tab contains the following properties:

  • Object class:
    The name of the object class. In order to successfully create AD objects, the object class provided here
    must exist in the AD schema.
  • Mandatory attributes:
    A list of mandatory attributes which should be used for the object class. Delimit multiple mandatory attributes with a semi-colon.

    Note:
    The mandatory attributes set in an object class definition are independent from the mandatory attributes
    defined in the Active Directory Schema. However, an object class definition must contain at least the
    mandatory attributes dictated by the schema.

Related Help Topics:

  • Using Object Class Definitions
  • Appendix D: Object Classes and Mandatory Attributes
  • AD Import > Object Class Definitions


NNS ADix - AD Import > Import Processing Logic

This topic contains a comprehensive description of the AD Import process. The information provided in this topic
helps you to understand how Active Directory objects are imported from a text-based file into Active Directory.

AD Import - Process Steps:

The AD Import process consists of the following steps:

  • Step I: Create Import Log
    The import log file will be created in this step. If this step fails, the entire AD Import operation
    will be stopped and the status of the operation is 'Failed'. The process continues with step VIII.
  • Step II: Check the Import File
    The import file will be checked whether it is a valid NNS ADix import file or not. If this step fails,
    the entire AD Import operation will be stopped and the status of the operation is 'Failed'. The process
    continues with step VI.
    The following checks will be performed in this step:
    • Step IIa: Open the Import File
      Opens the import file for read access. If this step fails, the entire AD Import operation will be
      stopped and the status of the operation is 'Failed'. The import process continues with step VI.
    • Step IIb: Check, if the file header contains any attributes for import
      Checks, whether the file header contains any other attributes than 'path', 'class' or the update key
      attribute. If this is not the case, the entire AD Import operation will be stopped and the status of the
      operation is 'Failed'. The process continues with step VI.
    • Step IIc: Compare the number of attributes in the header to the number of attributes
      in the first data row
      Checks, whether the the number of attributes in the file header is equal to the number of attributes in
      the first data row. If this is not the case, the entire AD Import operation will be stopped and the status
      of the operation is 'Failed'. The process continues with step VI.
    • Step IId: Check, if the attribute 'path' is present
      Checks, whether the file header contains the attribute 'path'. If this is not the case, the entire
      AD Import operation will be stopped and the status of the operation is 'Failed'. The process continues
      with step VI.
    • Step IIe: Check, if the attribute 'class' is present
      Checks, whether the file header contains the attribute 'class'. If this is not the case, a warning will be
      generated and the creation of new objects will be disabled. The process continues with step III in any case.
    • Step IIf: Check, if the specified Update Key Attribute is present
      Checks, whether the file header contains the specified update key attribute. If this is not the case, a warning will be
      generated and the attribute 'path' will be used for update operations. The process continues with step III in any case.
  • Step III: Retrieve the Object Class Definitions
    Retrieves the configured object class definitions. If no object class definitions are available, a warning will be
    generated and the creation of new objects will be disabled.
    If this step fails, the entire AD Import operation will be stopped and the status of the operation is 'Failed'. The process
    continues with step VI.
  • Step IV: Load Import Data
    The data in the import file will be loaded. If this step fails, the entire AD Import operation will be
    stopped and the status of the operation is 'Failed'. The process will continue with step VI.
  • Step V: Import Active Directory Objects
    The loaded import file will be parsed row by row and the AD objects provided by the import
    file will be either updated or created. This step is divided in several sub steps:
    • Step Va: Check current data row for items to import
      Checks, if the current data row contains any items to import. If this is not the case, the current object will
      be skipped, an error will be logged and the import process continues with step V using the next data row.
    • Step Vb: Compare the number of attributes in the header to the number of attributes
      in the current data row
      Checks, whether the number of attributes in the file header is equal to the number of attributes in
      the current data row. If this is not the case, the current object will be skipped, an error will be logged
      and the import process continues with step V using the next data row.
    • Step Vc: Check attribute 'path'
      Checks, whether the attribute 'path' contains any data. If this is not the case, the current object will be skipped,
      an error will be logged and the import process continues with step V using the next data row.
    • Step Vd: Check update key attribute
      Checks, whether the specified update key attribute any data. If this is not the case, the current object will be skipped,
      an error will be logged and the import process continues with step V using the next data row.
    • Step Ve: Get Import Operation Mode
      This steps checks whether an object already exists or not. If the object exists (Import Operation Mode 'UPDATE'),
      the import process continues with step Vf.
      If the object does not exist (Import Operation Mode 'CREATE'), the import process continues with step Vg.
      If this step fails, the current object will be skipped, an error will be logged and the import process continues with
      step V using the next data row.
    • Step Vf: Update Object
      The attributes provided in the import file will be updated. This process consists of the following
      steps:
      • Step Vf1: Get the object to update
        An attempt to access the object to update will be made. If this step fails, an error will
        be logged and the import process continues with step V using the next data row.
      • Step Vf2: Update Attributes
        The attributes specified in the import file are updated in this step. Every attribute
        will be parsed separately from each other. If one attribute fails (no permission,...), an error will be logged
        and the import process continues with step Vf2 (the next attribute will be updated).
    • Step Vg: Create Object
      This step creates an object using the attributes provided in the import file. This process consists of the following steps:
      • Step Vg1: Check, if the creation of new objects is enabled
        Checks, whether the creation of new objects is enabled or not. If the creation of new objects is enabled or not
        depends on the following conditions:
        - Is the option 'If object does not exist, create new object' is enabled?
        - Does the import file contain the attribute 'class'?
        - Are object class definitions available for the object to create?
        - Are all mandatory attributes for the given object class present in the import file?
        If all conditions are fulfilled, the creation of new objects is enabled. If not, the current object will be skipped,
        an error will be logged and the import process continues with step V using the next data row.
      • Step Vg2: Check, if the object parent path exists
        Checks, whether the parent path of the object exists. If this is not the case, the creation of the object will
        be delayed. Otherwise the object will be created. If the creation fails, an error will be logged and the
        process continues with step V using the next data row.
      • Step Vg3: Create the base object
        This step creates the base object (object with all mandatory attributes). If the creation fails, an error will be logged and the
        process continues with step V using the next data row.
      • Step Vg4: Set the remaining attributes (optional)
        The remaining attributes will be set in this step set. This step is optional, because if there are only mandatory
        attributes in the import file, all attributes are already set.
    • Step Vh: Check, if the import operation should be Canceled
      If the user cancels the operation (Cancel-button), the operation continues with step VI. Otherwise,
      step V will be the next step (the next object will be imported).
    • Step Vi: Create delayed Objects (optional)
      This step tries to create all delayed objects (if available). If the number of delayed objects does not decrease,
      the remaining delayed objects will be skipped. The process continues with step VI.
  • Step VI: Generate Import Statistics
    The import statistics will be created in this step.
  • Step VII: Finalize Import Log File
    The import log file will be finalized in this step.
  • Step VIII: End Import Process
    The AD Import operation has finished at this point.

AD Import - Process Flowchart:


NNS ADix - Toolbox

Use the Toolbox node to launch the ADix Log File Viewer, the ADix Converters dialog, the Active Directory Browser
or to view the System Information.

The section contains the following topics:

  • ADix Log File Viewer: Describes the ADix Log File Viewer property pages
  • ADix Converters: Describes the ADix Converter property pages
  • ADix GUID Generator: Describes the ADix GUID Generator property pages
  • Active Directory Browser: Describes the AD Browser dialogs and property pages


NNS ADix - Toolbox > ADix Log File Viewer

Use the ADix Log File Viewer to view export or import log files.

After you start the log file viewer a dialog will be displayed asking you for the log file to view.
Select the log file to view and click Open to load the log file.

The following tabs are used for the ADix Log File Viewer dialog:

  • General Tab: Contains general information about the loaded log file
  • Log Data Tab: Contains the detailed log data

Related Help Topics:

  • Viewing Log Files


NNS ADix - Toolbox > ADix Log File Viewer > General Tab

General Tab:

The General Tab contains some basic information about the current log file:

  • Software:
    The software used for the export/import operation.
  • Version:
    The software version.
  • Operation type:
    The type of operation. Is either ADExport or ADImport.
  • User context:
    The context used for the export/import operation.

Job Settings and Summary:

The Job Settings and Summary field contains the header and the summary section of the current log file.

The header of the log file contains information about the job settings used for the job.
The summary section provides basic information about the various steps performed during the operation. Further
this section contains export/import statistics.

Toolbar:

Click the Open a log file button to open another log file. The load status will be displayed on the right side of the button

Related Help Topics:

  • Toolbox > ADix Log File Viewer > Log Data Tab
  • Viewing Log Files


NNS ADix - Toolbox > ADix Log File Viewer > Log Data Tab

Log Data Tab:

The Log Data Tab contains detailed information about every step performed during the export/import operation:

List of Objects:

This list contains information for every object processed:

  • Status:
    The status of the operation for the current object:
    OK > The complete operation was successful
    Warning > Some steps could not be performed due to an error (e.g. an attribute value could not be exported because the attribute is empty)
    Error > The complete operation was unsuccessful
  • Result:
    Contains detailed result information.
  • Time:
    Contains the time when the operation was finished for a particular object.

Log Filter:

In order to minimize the amount of data provided by the list of objects, this list can be filtered using the
following criteria:

  • All entries:
    All log file entries will be displayed.
  • OK:
    Entries with the status "OK" will be displayed.
  • Warning:
    Entries with the status "Warning" will be displayed.
  • Error:
    Entries with the status "Error" will be displayed.

Note:
The filter criteria is applied using a logical OR-operation.

List of Attributes:

This list contains information for every attribute processed:

  • Status:
    The status of the operation for the current attribute:
    OK > The operation was successful
    Error > The operation was unsuccessful
  • Result
    Contains detailed result information.
  • Time:
    Contains the time when the operation was finished for a particular object.

Toolbar:

Click the Web lookup button to start a web lookup for the result message of the selected attribute. The result string will be submitted
to a configured web search engine and the results of this search will be displayed in your internet browser.

Related Help Topics:

  • Toolbox > ADix Log File Viewer > General Tab
  • Viewing Log Files


NNS ADix - Toolbox > ADix Converters

Use ADix Converters convert GUIDs, SIDs and other values into a form you can use in LDAP filters or import files.

The following tabs are used for the ADix Converters dialog:

  • GUID Conversion Tab: Enables you to convert GUIDs
  • SID Conversion Tab: Enables you to convert SIDs
  • Logon Hours Conversion Tab: Enables you to convert logon hours into a format you can use in queries or import files
  • Octet String Conversion Tab: Enables you to convert Octet Strings into various formats

Related Help Topics:

  • Using NNS ADix Converters


NNS ADix - Toolbox > ADix Converters > GUID Conversion Tab

GUID Conversion Tab:

Use the GUID Conversion Tab to convert a string formatted GUID into a hex formatted GUID and vice versa.

This tab contains the following properties:

  • LDAP search string compatible GUID (hex formatted):
    This field contains the conversion result in a form you can use in your LDAP queries. The field is read-only.
    Click the Copy this GUID to the clipboard button to copy the result to the clipboard.

String-to-Hex-GUID Conversion:

  • String GUID:
    A string formatted GUID. Use one of the following formats:
    • xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx (32 digits)
    • xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx (32 digits separated by hyphens)
    • {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx} (32 digits separated by hyphens, enclosed in brackets)
    • (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx) (32 digits separated by hyphens, enclosed in parentheses)
    Click the Convert button to convert the given GUID to a hex formatted GUID/LDAP search string compatible GUID.

Hex-to-String GUID Conversion:

  • Hex GUID:
    A hex formatted SID. Use one of the following formats:
    • 0xC0 0x05 ... (16 digit groups (2 digits/group), prefixed with 0x, separated by blanks)
    • \C0\05 ... (16 digit groups (2 digits/group), separated by back slashes)
    • C0 05 ... (16 digit groups (2 digits/group), separated by blanks)
    • C005 ... (32 digits)
    Click the Convert button to convert the given GUID to a string formatted GUID/LDAP search string compatible GUID.

Related Help Topics:

  • Toolbox > ADix Converters
  • How to...Search for a GUID


NNS ADix - Toolbox > ADix Converters > SID Conversion Tab

SID Conversion Tab:

Use the SID Conversion Tab to convert a string formatted SID into a hex formatted SID and vice versa.

This tab contains the following properties:

  • LDAP search string compatible SID (hex formatted):
    This field contains the conversion result in a form you can use in your LDAP queries. The field is read-only.
    Click the Copy this SID to the clipboard button to copy the result to the clipboard.

String-to-Hex-SID Conversion:

  • String SID:
    A string formatted SID. Use the following format:
    S-1-5-21-2127521184-1604012920-1887927527-72713
    Click the Convert button to convert the given SID to a hex formatted SID/LDAP search string compatible SID.

    You can also use the following well-known SIDs:
    SID String | Account Alias and corresponding RID
    AO | Account operators. The corresponding RID is DOMAIN_ALIAS_RID_ACCOUNT_OPS.
    RU | Alias to grant permissions to accounts that use applications compatible with Windows NT 4.0 operating systems. The corresponding RID is DOMAIN_ALIAS_RID_PREW2KCOMPACCESS.
    AN | Anonymous logon. The corresponding RID is SECURITY_ANONYMOUS_LOGON_RID.
    AU | Authenticated users. The corresponding RID is SECURITY_AUTHENTICATED_USER_RID.
    BA | Built-in administrators. The corresponding RID is DOMAIN_ALIAS_RID_ADMINS.
    BG | Built-in guests. The corresponding RID is DOMAIN_ALIAS_RID_GUESTS.
    BO | Backup operators. The corresponding RID is DOMAIN_ALIAS_RID_BACKUP_OPS.
    BU | Built-in users. The corresponding RID is DOMAIN_ALIAS_RID_USERS.
    CA | Certificate publishers. The corresponding RID is DOMAIN_GROUP_RID_CERT_ADMINS.
    CG | Creator group. The corresponding RID is SECURITY_CREATOR_GROUP_RID.
    CO | Creator owner. The corresponding RID is SECURITY_CREATOR_OWNER_RID.
    DA | Domain administrators. The corresponding RID is DOMAIN_GROUP_RID_ADMINS.
    DC | Domain computers. The corresponding RID is DOMAIN_GROUP_RID_COMPUTERS.
    DD | Domain controllers. The corresponding RID is DOMAIN_GROUP_RID_CONTROLLERS.
    DG | Domain guests. The corresponding RID is DOMAIN_GROUP_RID_GUESTS.
    DU | Domain users. The corresponding RID is DOMAIN_GROUP_RID_USERS.
    EA | Enterprise administrators. The corresponding RID is DOMAIN_GROUP_RID_ENTERPRISE_ADMINS.
    ED | Enterprise domain controllers. The corresponding RID is SECURITY_SERVER_LOGON_RID.
    WD | Everyone. The corresponding RID is SECURITY_WORLD_RID.
    PA | Group Policy administrators. The corresponding RID is DOMAIN_GROUP_RID_POLICY_ADMINS.
    IU | Interactively logged-on user. This is a group identifier added to the token of a process when it was logged on interactively. The corresponding logon type is LOGON32_LOGON_INTERACTIVE. The corresponding RID is SECURITY_INTERACTIVE_RID.
    LA | Local administrator. The corresponding RID is DOMAIN_USER_RID_ADMIN.
    LG | Local guest. The corresponding RID is DOMAIN_USER_RID_GUEST.
    LS | Local service account. The corresponding RID is SECURITY_LOCAL_SERVICE_RID.
    SY | Local system. The corresponding RID is SECURITY_LOCAL_SYSTEM_RID.
    NU | Network logon user. This is a group identifier added to the token of a process when it was logged on across a network. The corresponding logon type is LOGON32_LOGON_NETWORK. The corresponding RID is SECURITY_NETWORK_RID.
    NO | Network configuration operators. The corresponding RID is DOMAIN_ALIAS_RID_NETWORK_CONFIGURATION_OPS.
    NS | Network service account. The corresponding RID is SECURITY_NETWORK_SERVICE_RID.
    PO | Printer operators. The corresponding RID is DOMAIN_ALIAS_RID_PRINT_OPS.
    PS | Principal self. The corresponding RID is SECURITY_PRINCIPAL_SELF_RID.
    PU | Power users. The corresponding RID is DOMAIN_ALIAS_RID_POWER_USERS.
    RS | RAS servers group. The corresponding RID is DOMAIN_ALIAS_RID_RAS_SERVERS.
    RD | Terminal server users. The corresponding RID is DOMAIN_ALIAS_RID_REMOTE_DESKTOP_USERS.
    RE | Replicator. The corresponding RID is DOMAIN_ALIAS_RID_REPLICATOR.
    RC | Restricted code. This is a restricted token created using the CreateRestrictedToken function. The corresponding RID is SECURITY_RESTRICTED_CODE_RID.
    SA | Schema administrators. The corresponding RID is DOMAIN_GROUP_RID_SCHEMA_ADMINS.
    SO | Server operators. The corresponding RID is DOMAIN_ALIAS_RID_SYSTEM_OPS.
    SU | Service logon user. This is a group identifier added to the token of a process when it was logged as a service. The corresponding logon type is LOGON32_LOGON_SERVICE. The corresponding RID is SECURITY_SERVICE_RID.
  • Start SID conversion button:
    Click this button to convert the given SID.

Hex-to-String SID Conversion:

  • Hex SID:
    A hex formatted SID. Use one of the following formats:
    • 0xC0 0x05 ... (digit groups (2 digits/group), prefixed with 0x, separated by blanks)
    • \C0\05 ... (digit groups (2 digits/group), separated by back slashes)
    • C0 05 ... (digit groups (2 digits/group), separated by blanks)
    • C005 ... (an even number of digits)
    Click the Convert button to convert the given SID to a string formatted SID/LDAP search string compatible SID.

Related Help Topics:

  • Toolbox > ADix Converters
  • How to...Search for a SID


NNS ADix - Toolbox > ADix Converters > Logon Hours Conversion Tab

Logon Hours Conversion Tab:

Use the Logon Hours Conversion Tab to convert logon hours you have set in the logon hours grid into a format which
you can use in LDAP filters and import files.

This tab contains the following properties:

  • LDAP search string compatible logon hours (hex formatted):
    This field contains the conversion result in a form you can use in your LDAP queries. The field is read-only.
    Click the Copy this LDAP logonHours string to the clipboard button to copy the result to the clipboard.

Logon hours-to-Hex-String Conversion:

  • Logon Hours Grid:
    Set the time when logon should be permitted/denied in the logon hours grid. The Active time Bias field shows
    the offset to UTC in minutes. This value divided by 60 will be used as time zone offset when converting
    the logon hours.
  • Start logon hours-to-Hex-String conversion button:
    Click this button to convert the logon hours set in the grid.

Hex-String-to-Logon hours Conversion:

  • Hex formatted logon hours:
    A hex formatted logon hours string. Use one of the following formats:
    • 0xC0 0x05 ... (21 digit groups (2 digits/group), prefixed with 0x, separated by blanks)
    • \C0\05 ... (21 digit groups (2 digits/group), separated by back slashes)
    • C0 05 ... (21 digit groups (2 digits/group), separated by blanks)
    • C005 ... (42 digits)
    Click the Convert button to display the given logon hours string in the logon hours grid.

Related Help Topics:

  • Toolbox > ADix Converters
  • How To > Export/Import/Query Logon Hours
  • Configuration > Default Settings > Export Settings
  • Configuration > Default Settings > Import Settings


NNS ADix - Toolbox > ADix Converters > Octet String Conversion Tab

Octet String Conversion Tab:

Use the Octet String Conversion Tab to convert octet strings into a format which you can use in LDAP filters and import files.

This tab contains the following properties:

  • LDAP search string compatible Octet String (hex formatted):
    This field contains the conversion result in a form you can use in your LDAP queries. The field is read-only.
    Click the Copy this LDAP Octet String to the clipboard button to copy the result to the clipboard.

Octet-String Conversion:

  • Hex formatted octet string:
    A hex formatted octet string. Use one of the following formats:
    • 0xC0 0x05 ... (digit groups (2 digits/group), prefixed with 0x, separated by blanks)
    • \C0\05 ... (digit groups (2 digits/group), separated by back slashes)
    • C0 05 ... (digit groups (2 digits/group), separated by blanks)
    • C005 ... (42 digits)
    Choose from one of the octet string formats into which the string entered in the textbox should be converted to
    and click the Convert button to convert the string.

Related Help Topics:

  • Toolbox > ADix Converters


NNS ADix - Toolbox > ADix GUID Generator

Use the ADIx GUID generator tool to create a bunch of GUIDs which you can use in your import files.

Generate GUIDs Tab:

Use the Generate GUIDs Tab to configure parameters for the GUID creation and to finally generate the GUIDs.

This tab contains the following properties:

  • GUIDs to create:
    The number of GUIDs to create. Enter a value between 1 and 99.999.
  • GUID list seperator:
    Specify which separator should be used to separate the created GUIDs. If you avoid this setting,
    the GUIDs will be separated by a Carriage Return/Line Feed (CRLF).
  • GUID format:
    Use one of the following formats:
    • xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx (32 digits)
    • xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx (32 digits separated by hyphens)
    • {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx} (32 digits separated by hyphens, enclosed in brackets)
    • (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx) (32 digits separated by hyphens, enclosed in parentheses)
  • Start GUID generation:
    Click the Start GUID generation button to start GUID generation.
  • Cancel GUID generation process:
    Click the Cancel button to stop GUID generation at any time.
  • Copy GUIDs:
    Click the Copy to Clipboard button to copy the generated GUIDs to the clipboard.

Related Help Topics:

  • Toolbox > ADix Converters
  • How to...Search for a GUID


NNS ADix - Toolbox > Active Directory Browser

Use the Active Directory Browser to view the hierarchical structure of an entire Active Directory forest, tree, domain
or a branch of an AD domain.

In order to establish a connection to Active Directory, an AD Browser Profile is required. An AD Browser Profile provides
the connection settings which will be used to connect to Active Directory (see Toolbox > Active Directory Browser > AD Browser Profiles
for more information).

Active Directory Browser GUI:

The AD Browser GUI consists of the following items:

  • Main Menu
  • AD Browser Toolbar
  • Console Tree
  • Details Pane
  • AD Browser Status Bar

Main Menu:

The Main Menu contains the following items:

  • File > Add new profile:
    Starts the Create new profile dialog.
  • File > Exit:
    Quits the AD Browser.
  • Info > Help:
    Starts the help dialog.
  • Info > About NNS ADix:
    Starts the About NNS ADix dialog

AD Browser Toolbar:

The AD Browser Toolbar contains the following items:

  • Apply filter Button:
    Applies the filter specified in the filter textbox to the selected entry.

    Note:
    The filter applied for an entry will be not applied to its subentries.

  • Remove filter Button:
    Removes the current filter from the selected entry and sets the filter specified in the profile.

    Note:
    When a filter is deleted for an entry, the filters specified for subentries will not be deleted.

  • Filter Textbox:
    Contains the LDAP filter string to use for the selected entry.
  • Stop the current operation Button:
    Cancels the current query operation.

Console Tree:

The console tree contains all configured AD Browser Profiles. If you establish a connection to Active Directory
using one of the configured profiles, the root object specified in the profile will be displayed below the profile.
Every time you click on an entry, all available subentries will be displayed below the selected entry and in the
Details Pane.

Details Pane:

The Details Pane contains all subentries of the entry selected in the console tree.

The Details Pane Toolbar contains the following items:

  • Properties Button:
    Starts the Object Properties dialog.
  • Refresh Button:
    Refreshes the Details Pane.
  • Reanimate Tombstone(s) Button:
    Starts the Tombstone Reanimation dialog.
  • Export the list of objects into a CSV-file Button:
    Starts the Export list of objects dialog

AD Browser Status Bar:

The AD Browser Status Bar contains some information related to the current profile/selected object like the
object path of the currently selected object in the console tree, the state of the current profile and the credentials
used for the current profile.

Related Help Topics:

  • Using the AD Browser
  • Toolbox > Active Directory Browser > AD Browser Profiles


NNS ADix - Toolbox > Active Directory Browser > AD Browser Profiles

In order to establish a connection to Active Directory, an AD Browser Profile is required. An AD Browser Profile provides
the connection settings which will be used to connect to Active Directory.

The profiles are saved in the Registry on a per-user basis using the following key:
HCU\Software\NNS\ADix3\ADBrowser\[ProfileGUID]

The following tabs are used for the AD Browser Profile dialog:

  • General Tab: Contains basic settings for the AD Browser Profile
  • Advanced Tab: Enables you to set advanced settings

Related Help Topics:

  • Using the AD Browser
  • Toolbox > Active Directory Browser


NNS ADix - AD Browser Profiles > General Tab

General Tab:

The General Tab contains basic settings for the AD Browser Profile.

This tab contains the following properties:

  • Name:
    The name of the profile. This name must be unique.
  • Description:
    The description for the profile.

Connection Settings:

  • Host:
    The server to connect to. You can use the FQDN (DNS-style name), the NetBIOS name or the IP address of the DC.
  • Base DN:
    The starting point when connecting to Active Directory. Use the distinguished name syntax (e.g. dc=dom, dc=com).

    Note:
    If you want to connect to the RootDSE object, provide the value RootDSE in the Base DN field.

  • Port:
    The TCP/IP port to use when connecting to Active Directory. The default port is 389. Other default ports are 636 for
    SSL/LDAP and 3268 for the Global Catalog.

Credentials:

  • Specify credentials:
    Enable this option if you want to specify credentials (username and password) when connecting to Active Directory.
  • User name:
    The name of the user account you want to use for the connection.
    Valid formats are [Username], [DOMAIN\Username] or [username@domain.com].
  • Password:
    The password for the specified user account.

Related Help Topics:

  • Using the AD Browser
  • AD Browser Profiles > Advanced Tab


NNS ADix - AD Browser Profiles > Advanced Tab

Advanced Tab:

The Advanced Tab contains advanced settings for the AD Browser Profile.

This tab contains the following properties:

LDAP Settings:

  • Filter string:
    The default LDAP filter string to use for this profile. This filter will be applied on every branch you open in the console tree.
  • Max. entries:
    The maximum entries to return. A value of zero will return all objects
  • Include deleted objects:
    Enable this option if deleted objects should be displayed.

Referral Chasing Options:

  • None:
    Referrals will be ignored.
  • Subordinate:
    The client will chase continuation references. Continuation references occur when a subordinate naming context
    is requested. E.g. when searching the default naming context, a referral to the configuration naming context might be
    returned. If you enable this option, the configuration naming context will be displayed in the console tree.
  • External:
    The client will chase referrals in external domains. An external referral occurs when the server does not host the naming
    context, but gets a referral to another server that might host the required naming context.
    Enable this option if naming contexts not hosted by the server should be displayed in the console tree.
  • All:
    The client will chase continuation references and referrals in external domains.

Related Help Topics:

  • Using the AD Browser
  • AD Browser Profiles > General Tab


NNS ADix - Miscellaneous

The following property pages are used in miscellaneous other dialogs:

  • Connect As Property Page: Describes the Connect As dialog properties
  • Object Properties Page: Describes the object properties dialog properties
  • Attribute Properties Page: Describes the attribute properties dialog properties
  • Reanimate Tombstone(s) Property Page: Describes the reanimate tombstone(s) dialog properties


NNS ADix - Miscellaneous > Connect As Property Page

General Information:

This dialog enables you to submit other credentials than the current ones when...

  • previewing a Query Filter or browsing for a Query Root using the Query Filter dialog with the
    Browse/Preview: Ask for credentials option enabled or when
  • opening an Active Directory Browser connection where the Specify credentials option is enabled.

Connect As Properties:

The Connect As dialog contains the following properties:

  • User name:
    The name of the user account you want to use for the connection.
    Valid formats are [Username], [DOMAIN\Username] or [username@domain.com].
  • Password:
    The password for the specified user account.

Related Help Topics:

  • Using Query Filters
  • Using the AD Browser


NNS ADix - Miscellaneous > Object Properties Page

General Information:

This dialog enables you to view the properties of an Active Directory object.

Object Properties Page:

The Object Properties dialog contains the following properties:

  • Object path:
    The path to the object.
  • Object class:
    The name of the object class.

List of Attributes Properties:

The List of Attributes contains list of all attributes available for the given object. In addition this list provides
the following attribute properties:

  • Attribute Name:
    The LDAP display name (lDAPDisplayName) of the attribute.
  • Attribute Display Name:
    The display name of the attribute ("friendly" name).

    Note:
    The Active Directory schema does not provide a display name for every attribute. Therefore most of the
    display names are empty.

  • Attribute Syntax:
    The syntax of the attribute. For more information about attribute syntaxes see MSDN > ActiveDirectorySyntax Enumeration.
  • Attribute Value:
    The value(s) of the attribute.
  • GC:
    Provides information whether this attribute is a member of the Global Catalog or not.
  • MV:
    Provides information whether this attribute is multi-valued or not.
  • SA:
    Provides information whether this attribute is a system attribute or not.

    Note:
    System attributes will be managed by the directory service only. Therefore, system attributes can't be
    updated by NNS ADix.

  • RA:
    Provides information whether this attribute replicated between Domain Controllers or not.
  • CA:
    Provides information whether this attribute a constructed attribute or not.

    Note:
    Constructed attributes are not stored in the Active Directory database but are calculated on the fly by the
    directory service. Therefore, constructed attributes can't be updated by NNS ADix. Further they can't be used
    in query filters.

  • MA:
    Provides information whether this attribute is mandatory for the given object class or not.

Attribute Filter:

In order to minimize the amount of data provided by the list of attributes, this list can be filtered using the
following criteria:

  • All:
    All attributes will be displayed.
  • Mandatory attributes:
    The filtered result contains mandatory attributes (the value in the column "MA" contains an "X").
  • Optional attributes:
    The filtered result contains optional attributes (the value in the column "MA" is empty).
  • Only attributes that have values:
    The filtered result contains only non-empty attributes.
  • GC:
    The filtered result contains attributes which are members of the Global Catalog.
  • MV:
    The filtered result contains attributes which are multi-valued.
  • SA:
    The filtered result contains system attributes.
  • RA:
    The filtered result contains replicated attributes.
  • CA:
    The filtered result contains constructed attributes.

Note:
The filter criteria "Mandatory attributes", "Optional attributes" and "Only attributes that have values" are applied first
by using a logical AND-operation. All other criteria will be applied after the criteria mentioned before. A logical OR-operation will
be used for this criteria.


NNS ADix - Miscellaneous > Attribute Properties Page

General Information:

This dialog enables you to view the properties of an Active Directory attribute which is part of an
Active Directory object.

Attribute Properties Page:

The Attribute Properties dialog contains the following properties:

  • Attribute name (lDAPDisplayName):
    The LDAP display name (lDAPDisplayName) of the attribute.
  • Attribute Display Name:
    The display name of the attribute ("friendly" name).

    Note:
    The Active Directory schema does not provide a display name for every attribute. Therefore most of the
    display names are empty.

  • Attribute ID:
    The object ID (OID) for the selected attribute.
  • Attribute Syntax:
    The syntax of the attribute. For more information about attribute syntaxes see MSDN > ActiveDirectorySyntax Enumeration.
  • GC:
    Provides information whether this attribute is a member of the Global Catalog or not.
  • MV:
    Provides information whether this attribute is multi-valued or not.
  • SA:
    Provides information whether this attribute is a system attribute or not.

    Note:
    System attributes will be managed by the directory service only. Therefore, system attributes can't be
    updated by NNS ADix.

  • RA:
    Provides information whether this attribute replicated between Domain Controllers or not.
  • CA:
    Provides information whether this attribute a constructed attribute or not.

    Note:
    Constructed attributes are not stored in the Active Directory database but are calculated on the fly by the
    directory service. Therefore, constructed attributes can't be updated by NNS ADix. Further they can't be used
    in query filters.

  • MA:
    Provides information whether this attribute is mandatory for the given object class or not.
  • Attribute Values:
    The value(s) of the attribute.


NNS ADix - Miscellaneous > Reanimate Tombstone(s) Properties Page

General Information:

This dialog enables you to reanimate the selected Active Directory tombstones (deleted objects).

Reanimate Tombstone(s) Properties Page:

The Reanimate Tombstone(s) dialog contains the following properties:

  • Target container:
    The distinguished name of the container where the reanimated tombstones should be placed. All tombstones
    to reanimate will be placed into this container.

    Note:
    A target container can only be specified if the option "Use last known parent container as target container for the reanimated
    tombstone" is disabled.

  • Use last known parent container as target container for the reanimated tombstone:
    If this option is enabled, every tombstone will be placed into its last known parent container.

    Note:
    In order to place tombstones into their last known parent container, this container must exist before
    the tombstone reanimation will be started.

Reanimation Result Properties:

The List of Reanimation Results contains some pre-/post-tombstone reanimation information:

  • Status (pre-tombstone reanimation information):
    The current status of the object to reanimate:
    Death > The tombstone is ready to be reanimated
    Error > An error occurred during tombstone reanimation
    OK > The tombstone has been successfully reanimated
  • Tombstone (pre-tombstone reanimation information):
    The name (cn) of the object to reanimate
  • Last Known Parent Container (pre-tombstone reanimation information):
    The last known parent container of the object to reanimate
  • Target Container (post-tombstone reanimation information):
    The container into which the reanimated tombstone has been placed.
  • Result (post-tombstone reanimation information):
    The tombstone reanimation result.
  • Time (post-tombstone reanimation information):
    The time when the tombstone has been reanimated.

Related Help Topics:

  • How to...Reanimate Active Directory Tombstones


NNS ADix - How to...

This section contains the following topics:

  • How to...Create User Objects: Describes how to create user objects
  • How to...Create Computer Objects: Describes how to create computer objects
  • How to...Create Contact Objects: Describes how to create contact objects
  • How to...Create Group Objects: Describes how to create group objects
  • How to...Create Organizational Unit Objects: Describes how to create organizational unit objects
  • How to...Rename Objects: Describes how to rename an Active Directory object
  • How to...Set User Passwords: Describes how to set an user password
  • How to...Export Objects from an Entire Forest: Describes how to export objects from the entire Active Directory Forest
  • How to...Search for a GUID: Describes how to search for a GUID value
  • How to...Search for a SID: Describes how to search for a SID value
  • How to...Import an Attribute Value that should contain a CRLF: Describes how to import Carriage Return/Line Feed's (CRLF)
  • How to...Determine the Last Time a User Logged On to the Domain: Describes how to get the last logon of a user
  • How to...Query Active Directory using a Bitwise Filter: Describes how to use a bitwise filter in a LDAP query
  • How to...Clear an Attribute Value: Describes how to clear an attribute value
  • How to...Add an Attribute Value: Describes how to add attribute values to existing values
  • How to...Reanimate Active Directory Tombstones: Describes how to reanimate (undelete) deleted Active Directory objects
  • How to...Force Users to Change their Password at Next Logon: Describes how to force users to change their password at next logon
  • How to...Delete Active Directory Objects: Describes how to delete an Active Directory object
  • How to...Set a Boolean Attribute Value: Describes how to set a Boolean value for an attribute
  • How to...Export/Import/Query Logon Hours: Describes how to handle the attribute 'logonHours'
  • How to...Create Microsoft Exchange Recipient Objects Describes how to create Microsoft Exchange recipient objects
  • How to...Import or Export Terminal Services Related Attributes Describes how to import or export Terminal Services related attributes
  • How to...Import or Export Images Describes how to import or export images


NNS ADix - How to...Create User Objects

This topic describes how to create user objects with NNS ADix.

The following table contains a list attributes which are mandatory when creating user objects:

Attribute | Type | Description
path | single-valued | The object path of the user object to create. Example: LDAP://cn=j.doe,cn=users,dc=dom,dc=com
class | single-valued | Provides the object class. Must be set to 'user'.
sAMAccountName | single-valued | The pre-Windows 2000 logon name. The pre-Windows 2000 logon name is required to be unique across a domain.

In addition to the mandatory attributes you can set various optional attributes. The following table
contains a list of some attributes you can set:

Attribute | Type | Description
userPrincipalName | single-valued | A User Principal Name (UPN) is composed of a user account logon name and the user principal name suffix joined by the "@" sign. The UPN is required to be unique across the entire forest. Example: j.doe@dom.com
sn | single-valued | The last name of the user.
givenName | single-valued | The first name of the user.
memberOf | multi-valued | The groups, that the user is a member of. The import file can contain the distinguished names or the pre-Windows 2000 logon names of the groups. The Directory Services always stores these values as distinguished names.
userPassword | single-valued | The password of the user account to create. Please take in mind that the user password must be compliant with the domain security policy. E.g. if this policy prescribes a password length of 8 characters, you cannot set a password which is containing less than 8 characters.
... |  |

Example:

The following example creates an user object named 'j.doe' which is member of two groups:

path;class;sAMAccountName;userPrincipalName;sn;giveName;displayName;memberOf;userPassword
LDAP://cn=j.doe,cn=users,dc=dom,dc=com;user;jdoe;j.doe@dom.com;DOE;John;DOE John;cn=group1,ou=groups,dc=dom,dc=com|cn=group2,ou=groups,dc=dom,dc=com;P@ssw0rd


NNS ADix - How to...Create Computer Objects

This topic describes how to create computer objects with NNS ADix.

The following table contains a list attributes which are mandatory when creating user objects:

Attribute | Type | Description
path | single-valued | The object path of the computer object to create. Example: LDAP://cn=pc0001,cn=computers,dc=dom,dc=com
class | single-valued | Provides the object class. Must be set to 'computer'.
sAMAccountName | single-valued | The pre-Windows 2000 logon name. The pre-Windows 2000 logon name is required to be unique across a domain.

In addition to the mandatory attributes you can set various optional attributes. The following table
contains a list of some attributes you can set:

Attribute | Type | Description
userAccountControl | single-valued | Set this attribute value to 4096 if the computer object should be trusted by the domain.
netbootGUID | single-valued | If you want to pre-stage computer accounts RIS/WDS, provide the 128-bit UUID/GUID of the computer object to create. Example: {01234567-1234-1234-1234-012345678901} or 67452301341234121234012345678901
memberOf | multi-valued | The groups, that the computer is a member of. The import file can contain the distinguished names or the pre-Windows 2000 logon names of the groups. The Directory Services always stores these values as distinguished names.
... |  |

Example:

The following example creates a computer object named 'pc0001' which should be pre-staged for RIS/WDS installation:

path;class;sAMAccountName;netbootGUID;userAccountControl
LDAP://cn=pc0001,cn=computers,dc=dom,dc=com;computer;pc0001$;{01234567-1234-1234-1234-012345678901};4096


NNS ADix - How to...Create Contact Objects

This topic describes how to create contact objects with NNS ADix.

The following table contains a list attributes which are mandatory when creating contact objects:

Attribute | Type | Description
path | single-valued | The object path of the computer object to create. Example: LDAP://cn=j.doe,ou=contacts,dc=dom,dc=com
class | single-valued | Provides the object class. Must be set to 'contact'.
cn | single-valued | The name of the contact object. Example: j.doe

In addition to the mandatory attributes you can set various optional attributes. The following table
contains a list of some attributes you can set:

Attribute | Type | Description
sn | single-valued | The last name of the contact.
givenName | single-valued | The first name of the contact.
displayName | single-valued | The display name of the contact object. E.g. the display name is used in Microsoft Exchange address books.
memberOf | multi-valued | The groups, that the contact is a member of. The import file can contain the distinguished names or the pre-Windows 2000 logon names of the groups. The Directory Services always stores these values as distinguished names.
... |  |

Example:

The following example creates a contact named 'j.doe':

path;class;cn;sn;giveName;displayName
LDAP://cn=j.doe,ou=contacts,dc=dom,dc=com;contact;j.doe;DOE;John;DOE John


NNS ADix - How to...Create Group Objects

This topic describes how to create group objects with NNS ADix.

The following table contains a list attributes which are mandatory when creating group objects:

Attribute | Type | Description
path | single-valued | The object path of the computer object to create. Example: LDAP://cn=group1,ou=groups,dc=dom,dc=com
class | single-valued | Provides the object class. Must be set to 'group'.
sAMAccountName | single-valued | The pre-Windows 2000 logon name. The pre-Windows 2000 logon name is required to be unique across a domain.
groupType | singlevalued | The type of the group to create. For a list of valid values for this attribute see Appendix A: Valid Values for Attribute 'groupType'.

In addition to the mandatory attributes you can set various optional attributes. The following table
contains a list of some attributes you can set:

Attribute | Type | Description
memberOf | multi-valued | The groups, that the group is a member of. The import file can contain the distinguished names or the pre-Windows 2000 logon names of the groups. The Directory Services always stores these values as distinguished names.
member | multi-valued | The group members. The import file can contain the distinguished names or the pre-Windows 2000 logon names of the groups. The Directory Services always stores these values as distinguished names.
... |  |

Example:

The following example creates a global security group named 'group1' which has one member:

path;class;sAMAccountName;groupType;member
LDAP://cn=group1,ou=groups,dc=dom,dc=com;group;group1;-2147483646;cn=j.doe,cn=users,dc=dom,dc=com


NNS ADix - How to...Create Organizational Unit Objects

This topic describes how to create organizational unit objects with NNS ADix.

The following table contains a list attributes which are mandatory when creating organizational unit objects:

Attribute | Type | Description
path | single-valued | The object path of the computer object to create. Example: LDAP://ou=myOU,dc=dom,dc=com
class | single-valued | Provides the object class. Must be set to 'group'.
ou | single-valued | The name of the organizational unit. Example: myOU

In addition to the mandatory attributes you can set various optional attributes. The following table
contains a list of some attributes you can set:

Attribute | Type | Description
description | multi-valued | The description of the OU. Despite this attribute is multi-valued, only the last description set in a multi-valued string will be displayed in the ADUC-tool (ADUC=Active Directory Users and Computers). E.g. if you set the description to Description1|Description2, only the value Description2 will be displayed in the ADUC-tool.
... |  |

Example:

The following example creates an organizational unit object named 'myOU':

path;class;ou;description
LDAP://ou=myOU,dc=dom,dc=com;organizationalUnit;myOU;This is my OU


NNS ADix - How to...Add an Attribute Value

This topic describes how to add an attribute value to an existing value.

Importing attribute values is per default a replace-operation. This means that the value of an attribute
will be replaced with the value specified in the import file.

If you want to add an attribute value to an existing value, you must use a leading \ADD\-string
for every attribute which value(s) should be added to an existing value.

Example:

The following example adds two new values to the attribute 'proxyAddresses':

path;class;proxyAddresses
LDAP://cn=j.doe,cn=users,dc=dom,dc=com;\ADD\smtp:jonny@dom.com|smtp:doe@dom.com

Note:
The \ADD\-string is case sensitive. Therefore always write the string in capital letters.
Further use only one \ADD\-string for the whole attribute value(s) to add.


NNS ADix - How to...Set User Passwords

This topic describes how to set user passwords with NNS ADix.

In order to set the password for an user object perform the following steps:

  • Use the attribute 'userPassword' in the import file
  • Edit the values for the attribute 'userPassword'
  • Save the changes made to the import file
  • Import the file

Note:
Please take in mind that the user password must be compliant with the domain security policy.
E.g. if this policy prescribes a password length of 8 characters, you cannot set a password which is consists of less than 8 characters.


NNS ADix - How to...Export Objects from an Entire Forest

This topic describes how to export objects from an entire Active Directory Forest with NNS ADix.

If you need to export objects from an entire Active Directory Forest, you may either run an export operation against each
domain in the forest, or alternatively, perform an export operation using the Global Catalog (GC).

In order to perform an export operation using the (GC) perform the following steps:

  • Create a query filter using the following Query Root: GC://<GCServerName>
    <GCServerName> represents the name of a Global Catalog server.
    Example: GC://dc01.dom.com
  • Select the option Include subcontainers to include all objects in every sub container of each domain.
  • Use this query filter settings when exporting objects

Note:
If you want to import the data you have previously exported, you must replace the prefix
GC://<GCServerName> with the prefix LDAP://.
Example: Replace GC://dc1.dom.com/ with LDAP://.

Note:
The monikers LDAP: and GC: are case sensitive. Always write them in capital letters.


NNS ADix - How to...Search for a GUID

This topic describes how to search for Active Directory objects using a GUID.

If you need to search for a GUID, you must submit the GUID you are searching for in
a special form:

\37\16\E3\96\F3\59\D0\11\AD\1F\00\AA\00\A2\19\AA

As you do not always have the GUID in the form mentioned above, you have to convert the GUID first.

Example:

GUID to convert:

{96E31637-59F3-11D0-AD1F-00AA00A219AA}

GUID converted:

\37\16\E3\96\F3\59\D0\11\AD\1F\00\AA\00\A2\19\AA

Note:
If you are searching for GUIDs, you can use placeholders.
Example: objectGUID=\37\16\E3\96\F3\59\D0\11\AD\1F\00\AA\00*

Related Help Topics:

  • Using NNS ADix Converters


NNS ADix - How to...Search for a SID

This topic describes how to search for Active Directory objects using a SID.

If you need to search for a SID, you must submit the SID you are searching for in
a special form:

\01\02\00\00\00\00\00\05\20\00\00\00\20\02\00\00\00\00\00\00\00\00\00\00\03\00\04\00

As you do not always have the SID in the form mentioned above, you have to convert the SID first.

Example:

SID to convert:

S-1-5-32-544

SID converted:

\01\02\00\00\00\00\00\05\20\00\00\00\20\02\00\00\00\00\00\00\00\00\00\00\03\00\04\00

Note:
If you are searching for SIDs, you can use placeholders.
Example: objectSID=\01\02\00\00\00\00\00\05\20\00\00\00\20\02*

Related Help Topics:

  • Using NNS ADix Converters


NNS ADix - How to...Import an Attribute Value that should contain a CRLF

This topic describes how to import Carriage Return/Line Feed's (CRLF).

If you need to import attribute values which should contain CRLFs (Carriage Return/Line Feed), you must
set the \CRLF\-string in the import file everywhere you want to set a CRLF.

Example:

The following example sets a CRLF for the attribute 'info':

path;class;info
LDAP://cn=j.doe,cn=users,dc=dom,dc=com;This is \CRLF\an info!

Note:
The \CRLF\-string is case sensitive. Therefore always write the string in capital letters.


NNS ADix - How to...Determine the Last Time a User Logged On to the Domain

This topic describes how to determine the last logon time of a user account.

There are two attributes in Active Directory and one NNS ADix auxiliary attribute which can be used to determine
the last time a user logged on to the domain:

  • lastLogon
  • lastLogonTimestamp (available since Windows 2003)
  • lastDomainLogon (NNS ADix auxiliary attribute)

Both the 'lastLogon' and the 'lastLogonTimestamp' attribute are using the large Integer (64-bit Integer) syntax
to store the logon times. This means that the data is not stored as date/time, it is stored as a large integer.
This is because the time will be derived using the date 1601-01-01 00:00:00 as starting point and using
100-nanosecond intervals since that date to represent the last logon time of the user.

Note:
To convert the large integer representation to a date/time format use the NNS ADix Large Integer to Date
String Conversion option. See Export Settings > Attribute Syntax Conversion Tab for more information.

Attribute 'lastLogon':

This attribute contains the last logon time on a specific domain controller. The attribute is not replicated
throughout the domain! So if you want to determine the last time a user logged on to the domain, you have to
query every domain controller in your domain for this attribute.

Attribute 'lastLogonTimestamp':

This attribute is available since Windows 2003. The lastLogonTimestamp-attribute keeps track of the last time a
user logged on to the domain and it is replicated from one domain controller to another.
To minimize replication traffic, the 'lastLogonTimestamp' is replicated only once every 14 days. This means that
the 'lastLogonTimestamp' for any given user could be off by as much as 14 days.

Attribute 'lastDomainLogon':

Actually 'lastDomainLogon' is not an Active Directory attribute. This attribute will be used by NNS ADix to determine
the last time a user logged on to the domain. If you use this attribute in an export operation, NNS ADix will query
every available DC for the attribute 'lastLogon'. The most recent value will be exported using the
'lastDomainLogon' attribute. Further the DC with the most recent logon will be logged in the export log file.
If a user never logged on to the domain, the date 1601-01-01 00:00:00 will be exported.

Note:
You can set a list of DCs which should be excluded when querying for the 'lastLogonDomain'.
See Export Settings > Advanced Tab for more information.

Note:
The attribute 'lastLogonDomain' must be converted from large integer representation to a date/time
format. Use the NNS ADix Large Integer to Date String Conversion option and add this attribute to the list.
If this attribute is not added for conversion, the date 1601-01-01 00:00:00 will be exported for every object.
See Export Settings > Attribute Syntax Conversion Tab for more information.

Note:
As the attribute 'lastLogonDomain' is not an Active Directory attribute, you cannot view its value using
the object property dialogs. You can add this attribute to an attribute file for more convenience when
selecting attributes for export.

Note:
The attribute 'lastLogonDomain' is only valid for objects of type user, computer and INetOrgPerson. If the
attribute is used for objects of other types, an error will be logged.


NNS ADix - How to...Query Active Directory using a Bitwise Filter

This topic describes how to use bitwise filters in LDAP queries.

Some attributes are composed of bitwise flags (e.g. 'userAccountControl'). You may need to query for
objects using a bitwise operator to return only objects that match a particular bit being set.
Use the LDAP Matching Rule controls to do this.

The format of the LDAP Matching Rule has the following syntax:

attributename:ruleOID:=value

attributename is the LDAP display name of the attribute, ruleOID is the object ID (OID) for the matching
rule control, and value is the decimal value you want to use for comparison. You need to convert from
hexadecimal to decimal.

The value of ruleOID can be one of the following:

  • 1.2.840.113556.1.4.803 - This is the LDAP_MATCHING_RULE_BIT_AND rule. The matching rule is true
    only if all bits from the property match the value. This rule is like the bitwise AND operator.
  • 1.2.840.113556.1.4.804 - This is the LDAP_MATCHING_RULE_BIT_OR rule. The matching rule is true
    if any bits from the property match the value. This rule is like the bitwise OR operator. (available since Windows 2003)

An example is when you want to query Active Directory for user class objects that are disabled. The attribute that holds this
information is the 'userAccountControl'-attribute. This attribute is composed of a combination of different flags.
The flag for setting the object that you want to disable is UF_ACCOUNTDISABLE, which has a value of 0x02 (2 decimal). The
bitwise comparison filter that specifies 'userAccountControl' with the UF_ACCOUNTDISABLED bit set would resemble this:

(userAccountControl:1.2.840.113556.1.4.803:=2)

Related Help Topics:

  • Appendix B: Valid Values for Attribute 'userAccountControl'


NNS ADix - How to...Clear an Attribute Value

This topic describes how to clear the value of an attribute with.

If you want to clear/delete an attribute value, you must use the \CLR\-string in the import file
for every attribute which value(s) should be deleted.

Example:

The following example clears the value of the attribute 'description':

path;class;description
LDAP://cn=j.doe,cn=users,dc=dom,dc=com;\CLR\

Note:
The \CRL\-string is case sensitive. Therefore always write the string in capital letters.
Further this string must be the only value to set. Otherwise the attribute value(s) will not be cleared. E.g. instead the whole
value will be set: \CLR\This is a description


NNS ADix - How to...Rename Objects

This topic describes how to rename objects with NNS ADix.

In order to rename Active Directory objects with NNS ADix perform the following steps:

  • Export all objects you ant to rename (select the attribute 'cn' for export)
  • Open the export file with an editor and edit the values for the attribute 'cn'.
    Do not change the attribute 'path'! This will be done automatically at the time the file is imported.
  • Save the changes made to the import file
  • Import the file

Note:
In order to rename objects of type 'organizational unit' do not export and edit the attribute 'cn'.
Instead use the attribute 'ou' to rename organizational unit objects.


NNS ADix - How to...Reanimate Active Directory Tombstones

General Information:

When an Active Directory object is deleted, the object is not immediately removed from the Active Directory
database. Instead, the object will be turned into a tombstone. This is because the object deletion must be propagated
to other domain controllers.
NNS ADix enables you to conveniently reanimate Active Directory tombstones.

The following changes will be made to an object when it is deleted:
- The value of the "isDeleted" attribute is set to "TRUE"
- Most of the attribute values are stripped of
- The object will be renamed to something like CN=oldRDN\0ADEL:objectGUID and
moved to a special container in the objects naming context called "CN=Deleted Objects"
- The distinguished name of the objects original location will be saved in an attribute called "lastKnownParent"
(this feature is supported on Windows Server 2003 or higher)

Tombstones are removed from the Active Directory database after the tombstone lifetime has expired.
The default tombstone lifetimes are...
- Forest initially built using Windows Server 2000/Windows Server 2003: 60 days
- Forest initially built using Windows Server 2003 SP1 or higher: 180 days

Note:
Windows Server 2008 R2 has a new feature called "Active Directory Recycle Bin". This feature enables you to retain
all link-valued and non-link-valued attributes of the deleted Active Directory objects. This values are preserved and the objects are restored
in their entirety to the same consistent logical state that they were in immediately before deletion. For example, restored user accounts
automatically regain all group memberships and corresponding access rights that they had immediately before deletion, within and across domains.

Please refer to the following link to get more information about enabling and using this feature: Active Directory Recycle Bin Step-by-Step Guide

Reanimating Tombstones:

NNS ADix provides two capabilities to reanimate tombstones:
- The Query Filter Preview dialog
- The AD Browser

To reanimate tombstones using the Query Filter Preview dialog...

  • Create a new query filter
  • Set the query root to LDAP://CN=Deleted Objects, DC=<DomainNamingContext> (e.g. LDAP://CN=Deleted Objects, DC=dom, DC=com)
  • Select the Include deleted objects option
  • Use the following query filter: (isDeleted=*)

    Note:
    You can adjust the query filter to your needs. E.g. to return only deleted group objects,
    use the following query string: (&(isDeleted=*)(objectClass=group))

  • Click the Preview button to open the Query Filter Preview dialog.
  • Select the tombstones you want to reanimate and click the Reanimate Tombstone button on the bottom of the query filter result list.
    The Reanimate Tombstone dialog appears on the screen.
  • Choose the parent container where the reanimated tombstones will be placed
  • Click the Start Reanimation button to start the tombstone reanimation
  • Check the tombstone reanimation results for any errors

To reanimate tombstones using the AD Browser...

  • Create a new AD Browser profile or edit an existing one and provide the following setting:
    Advanced tab->select Include deleted objects option
  • Save the profile and connect to Active Directory using the specified profile
  • Locate the deleted objects container in the AD Browser console tree and left-click this container. The Reanimate Tombstone
    dialog     appears on the screen.
  • Choose the parent container where the reanimated tombstones will be placed
  • Click the Start Reanimation button to start the tombstone reanimation
  • Check the tombstone reanimation results for any errors

Related Help Topics:

  • Toolbox > Active Directory Browser > AD Browser Profiles
  • AD Export > Query Filters > Query Filter Properties


NNS ADix - How to...Force Users to Change their Password at Next Logon

This topic describes how to force users to change their password at next logon with NNS ADix.

In order to force users to change their password at next logon with NNS ADix perform the following steps:

  • Use the attribute 'pwdLastSet' in the import file
  • Set the value for the attribute 'pwdLastSet' to 0
  • Save the changes made to the import file
  • Import the file

Note:
If this value is set to 0 and the attribute 'userAccountControl' does not contain the UF_DONT_EXPIRE_PASSWD flag,
the user must set the password at the next logon.


NNS ADix - How to...Delete Active Directory Objects

This topic describes how to delete Active Directory objects with NNS ADix.

If you want to delete an Active Directory object, you must use the ADix auxiliary attribute 'adixDel' in
your import file (see the help topic Appendix F: Auxiliary Attributes for more information).
The value of this attribute be set to 'DEL' for a single object deletion or to 'DELTREE'
to delete an entire object tree. Further the import file must contain a valid Update Key Attribute.

Note:
The DELOBJ (DELTREE)-string is case sensitive. Therefore always write the string in capital letters.

Note:
If the import file contains other attributes than the Update Key Attribute and the attribute 'adixDel', these
attributes will be ignored. Only delete operations will be performed.

Examples:

The following example deletes an object using the Update Key Attribute 'path':

path;adixDel
"LDAP://cn=j.doe,cn=users,dc=dom,dc=com";"DELOBJ"

The following example deletes an object and it's child objects using the Update Key Attribute 'gUIDPath':

gUIDPath;adixDel
LDAP://<GUID=08593c87-4f62-45da-911c-a62dadc47351>";"DELTREE"

The following example deletes an object using the Update Key Attribute 'sAMAccountName':

sAMAccountName;adixMan
"jdoe";"DELOBJ"

Note:
Be careful when using the 'DELTREE'-string. It enables you to delete an entire directory tree (including all child objects)
with one line in the import file!


NNS ADix - How to...Set a Boolean Attribute Value

This topic describes how to set Boolean attribute values with NNS ADix.

If you want to import attribute values for attributes which syntax must be 'Boolean', you must use
either the values '$True' or '$False' for these attributes.

Examples:

The following example sets the value of the Boolean attribute 'mDBUseDefaults' to 'True':

path;mDBUseDefaults
"LDAP://cn=j.doe,cn=users,dc=dom,dc=com";"$True"

Note:
In NNS ADix versions prior to v3.3, Boolean values can be imported using the values 'TRUE' or 'FALSE'
(in upper-case letters!).
In version 3.3 or later you can also use these values, but we recommend to use
'$True' or '$False', because these values are not case-sensitive. Further if you are exporting Boolean
values, these values will be exported as '$True' or '$False'.


NNS ADix - How to...Export/Import/Query Logon Hours

This topic describes how to handle the attribute 'logonHours' with NNS ADix.

General Information:

Logon hours are stored in Active Directory using the attribute 'logonHours'. The value is stored as a byte array
containing 21 bytes. Each bit in the byte array represents an hour in a 7-day week (24 hours x 7 days = 168 bits = 21 bytes).
A bit of value zero means that logon is denied at this hour, a bit of value one means that logon is permitted.

Values in the logonHours-attribute are stored in UTC format, therefore the array is offset by your local computer Time Zone Bias.

Note:
Local computer Time Zone Bias is stored in the registry (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TimeZoneInformation)
using the following values:
- ActiveTimeBias: This value is the current time difference from UTC in minutes and is the difference for UTC.
E.g., if you are 1 hour ahead, UTC is 1 hour behind. The value would be ffffffc4, which is hexadecimal for -60. We use
this value divided by 60 as time zone offset when converting logon hours.
- Bias: This value is the normal time difference from UTC, excluding daylight saving in minutes.
- DaylightBias: This value is the time difference used for daylight saving for UTC. If you are 1 hour ahead, the value is ffffffc4,
which is hex for -60. Note that the ActiveTimeBias is the sum of Bias and DaylightBias in daylight saving months, which is the same as
Bias for standard months.

Export Logon Hours:

In order to export value of the attribute 'logonHours', simply select this attribute for export. The value will be exported using one
of the following formats (see Export Settings > Attribute Syntax Conversions > Octet-String Conversion for more information):
- 0xC0 0x05 ... (digit groups (2 digits/group), prefixed with 0x, separated by blanks)
- \C0\05 ... (digit groups (2 digits/group), separated by back slashes)
- C0 05 ... (digit groups (2 digits/group), separated by blanks)
- C005 ... (42 digits)

Import Logon Hours:

In order to import values for the attribute 'logonHours', the import file must contain this attribute in the header of the import file and
the value must be formatted using one of the following formats:
- 0xC0 0x05 ... (21 digit groups (2 digits/group), prefixed with 0x, separated by blanks)
- \C0\05 ... (21 digit groups (2 digits/group), separated by back slashes)
- C0 05 ... (21 digit groups (2 digits/group), separated by blanks)
- C005 ... (42 digits)

Furthermore this attribute must be configured for String-to-Octet-String conversion (see Import Settings > Attribute Syntax Conversions > Octet-String Conversion
for more information).

Note:
In NNS ADix versions prior to v3.4, the import of the attribute 'logonHours' is not supported.

Example:

path;logonHours
"LDAP://cn=j.doe,cn=users,dc=dom,dc=com";"0x00 0x00 0x80 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0x7F 0x00 0x00 0x00"

Query for Logon Hours:

You can query for logon hours using the 'logonHours'-attribute in your LDAP query and format the value
to query for using the following format:
- \C0\05 ... (21 digit groups (2 digits/group), separated by back slashes)

Examples:

(&(objectCategory=person)(objectClass=user)(logonHours=\00\00\80\FF\FF\FF\FF\FF\FF\FF\FF\FF\FF\FF\FF\FF\FF\7F\00\00\00))

(&(objectCategory=person)(objectClass=user)(logonHours=\00\00\80\FF\FF\FF\FF\FF\FF\FF\FF\FF\FF\FF\FF\FF\FF*))

Related Help Topics:

  • Configuration > Default Settings > Export Settings
  • Configuration > Default Settings > Import Settings
  • Toolbox > ADix Converters


NNS ADix - How to...Create Microsoft Exchange Recipient Objects

This topic describes how to create Microsoft Exchange recipient objects with NNS ADix.

General

With NNS ADix you can create Microsoft Exchange recipients or update Exchange-related attributes on those recipients. A
recipient is any mail-enabled object in Active Directory to which Exchange can deliver or route messages.

Basically there are four types of recipients in Microsoft Exchange:

  • Mailboxes/Mailbox-Enabled Users: A mailbox that's assigned to an individual user in your Exchange organization
  • Mail Users: A mail-enabled Active Directory user that represents a user outside the Exchange organization
  • Mail Contacts: A mail-enabled Active Directory contact that contains information about people
    or organizations that exist outside the Exchange organization
  • Distribution Groups: Mail-enabled Active Directory group objects that are primarily used for
    distributing messages to multiple recipients

For more information about Exchange recipient types see ...:

  • Microsoft Technet - Understanding Recipients

There are different procedures for the various Exchange versions. The following topics are providing information
for Exchange 2000/2003, Exchange 2007 and Exchange 2010.

Mailboxes/Mailbox-Enabled Users

This topic describes how to create mailbox-enabled users with NNS ADix.

Note:
In order to create mailbox-enabled users, an Active Directory user object must be created. Please see
the following topic to get information about creating user objects with NNS ADix: NNS ADix - How to...Create User Objects

Exchange 2000/2003

The following table contains a list of mandatory attributes which are required to create Exchange Server 2000/2003
mailbox-enabled objects in Active Directory:

Attribute | Type | Description
mailNickname | single-valued | This attribute is the alias to the mailbox.
homeMTA homeMDB msExchHomeServerName | single-valued | One of the following attributes is mandatory for mailbox-enabled objects: homeMTA: This attribute is a distinguished name to the Message Transfer Agent (MTA) object where your mailbox resides. homeMDB: This attribute is a distinguished name to the private Messaging Database (MDB) where your mailbox resides. msExchHomeServerName: This attribute is the legacy distinguished name to the server where you have a mailbox (e.g. /o=org/ou=site/cn=configuration/cn=servers/cn=server).
msExchMailboxGuid | single-valued | This attribute contains the GUID for the mailbox to create. You can randomly generate GUIDs using the ADix Toolbox tool "ADix GUID Generator".

Note:
In Exchange 2000/2003 recipients are partially provisioned after their creation. The
Recipient Update Service (RUS) is responsible for setting the remaining attributes.

Example:

The following example creates a mailbox for an existing user named 'j.doe' on Exchange 2000/2003:

path;mailNickName;msExchMailboxGuid;homeMDB
LDAP://cn=j.doe,cn=users,dc=dom,dc=com;jdoe;j.doe;f4ba36ccbd8442cd8ff96bb6dda2daaa;CN=MBS,CN=SG1,CN=InformationStore,CN=EX01,CN=Servers,CN=first administrative group,CN=Administrative Groups,CN=DOM,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=dom,DC=com

Exchange 2007

The following table contains a list of mandatory attributes which are required to create Exchange Server 2007
mailbox-enabled objects in Active Directory:

Attribute | Type | Description
mailNickname | single-valued | This attribute is the alias to the mailbox.
homeMTA homeMDB msExchHomeServerName | single-valued | In order to create Exchange 2007 mailbox-enabled objects, ALL 3 attributes must be present: homeMTA: This attribute is a distinguished name to the Message Transfer Agent (MTA) object where your mailbox resides. homeMDB: This attribute is a distinguished name to the private Messaging Database (MDB) where your mailbox resides. msExchHomeServerName: This attribute is the legacy distinguished name to the server where you have a mailbox (e.g. /o=org/ou=site/cn=configuration/cn=servers/cn=server).
msExchMailboxGuid | single-valued | This attribute contains the GUID for the mailbox to create. You can randomly generate GUIDs using the ADix Toolbox tool "ADix GUID Generator".

Note:
In Exchange 2007 there is no RUS which is setting the remaining Exchange attributes automatically.
Therefore if you want to bulk import mailbox-enabled/mail-enabled Exchange 2007 user objects using NNS ADix,
perform the following steps:
1) Import the user objects using NNS ADix
2) Execute the following Exchange Management Shell command: get-mailbox | set-mailbox –ApplyMandatoryProperties

Example:

The following example creates a mailbox for an existing user named 'j.doe' on Exchange 2007:

path;mailNickName;msExchMailboxGuid;homeMDB;homeMTA;msExchHomeServerName
LDAP://cn=j.doe,cn=users,dc=dom,dc=com;jdoe;j.doe;f4ba36ccbd8442cd8ff96bb6dda2daaa;CN=MBS,CN=SG1,CN=InformationStore,CN=EX01,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=First Organization,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=dom,DC=com;CN=Microsoft MTA,CN=EX01,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=First Organization,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=dom,DC=com;/o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=EX01

Exchange 2010

The following table contains a list of mandatory attributes which are required to create Exchange Server 2010
mailbox-enabled objects in Active Directory:

Attribute | Type | Description
mailNickname | single-valued | This attribute is the alias to the mailbox.
homeMDB msExchHomeServerName | single-valued | In order to create Exchange 2010 mailbox-enabled objects, ALL 2 attributes must be present: homeMDB: This attribute is a distinguished name to the private Messaging Database (MDB) where your mailbox resides. msExchHomeServerName: This attribute is the legacy distinguished name to the server where you have a mailbox (e.g. /o=org/ou=site/cn=configuration/cn=servers/cn=server).

Note:
In Exchange 2010 there is no RUS which is setting the remaining Exchange attributes automatically.
Therefore if you want to bulk import mailbox-enabled/mail-enabled Exchange 2010 user objects using NNS ADix,
perform the following steps:
1) Import the user objects using NNS ADix
2) Execute the following Exchange Management Shell command: get-mailbox | update-recipient

Example:

The following example creates a mailbox for an existing user named 'j.doe' on Exchange 2010:

path;mailNickName;homeMDB;msExchHomeServerName
LDAP://cn=j.doe,cn=users,dc=dom,dc=com;jdoe;j.doe;CN=MBS,CN=SG1,CN=InformationStore,CN=EX01,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=First Organization,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=dom,DC=com;/o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=EX01

.top

Mail Users

This topic describes how to create mail users with NNS ADix.

Note:
In order to create mail users, an Active Directory user object must be created. Please see
the following topic to get information about creating user objects with NNS ADix: NNS ADix - How to...Create User Objects

Exchange 2000/2003

The following table contains a list of mandatory attributes which are required to create Exchange Server 2000/2003
mail user objects in Active Directory:

Attribute | Type | Description
mailNickname | single-valued | This attribute is the alias to the mail user.
targetAddress | single-valued | This attribute is the e-mail address to which you want to redirect the mail. This attribute is formatted like the proxyAddresses attribute, where there is a prefix that defines the address type (e.g. "SMTP:j.doe@dom.com".

Note:
In Exchange 2000/2003 recipients are partially provisioned after their creation. The
Recipient Update Service (RUS) is responsible for setting the remaining attributes.

Example:

The following example mail-enables an existing user named 'j.doe' on Exchange 2000/2003:

path;mailNickName;targetAddress
LDAP://cn=j.doe,cn=users,dc=dom,dc=com;jdoe;SMTP:j.doe@otherdom.com

Exchange 2007/2010

Use the same attributes as for Exchange 2000/2003.

Note:
In Exchange 2007/2010 there is no RUS which is setting the remaining Exchange attributes automatically.
Therefore if you want to bulk import mail-enabled Exchange 2007/2010 user objects using NNS ADix,
perform the following steps:

Exchange 2007:
1) Import the user objects using NNS ADix
2) Execute the following Exchange Management Shell command: get-mailuser | set-mailuser

Exchange 2010:
 1) Import the user objects using NNS ADix
2) Execute the following Exchange Management Shell command: get-mailuser | update-recipient

.top

Mail Contacts

This topic describes how to create mail contacts with NNS ADix.

Note:
In order to create mail contacts, an Active Directory contact object must be created. Please see
the following topic to get information about creating contact objects with NNS ADix: NNS ADix - How to...Create Contact Objects

Exchange 2000/2003

The following table contains a list of mandatory attributes which are required to create Exchange Server 2000/2003
mail contact objects in Active Directory:

Attribute | Type | Description
mailNickname | single-valued | This attribute is the alias to the contact.
targetAddress | single-valued | This attribute is the e-mail address to which you want to redirect the mail. This attribute is formatted like the proxyAddresses attribute, where there is a prefix that defines the address type (e.g. "SMTP:j.doe@dom.com".

Note:
In Exchange 2000/2003 recipients are partially provisioned after their creation. The
Recipient Update Service (RUS) is responsible for setting the remaining attributes.

Example:

The following example mail-enables an existing contact named 'j.doe' on Exchange 2000/2003:

path;mailNickName;targetAddress
LDAP://cn=j.doe,cn=users,dc=dom,dc=com;jdoe;SMTP:j.doe@otherdom.com

Exchange 2007/2010

Use the same attributes as for Exchange 2000/2003.

Note:
In Exchange 2007/2010 there is no RUS which is setting the remaining Exchange attributes automatically.
Therefore if you want to bulk import mail-enabled Exchange 2007/2010 contact objects using NNS ADix,
perform the following steps:

Exchange 2007:
1) Import the contact objects using NNS ADix
2) Execute the following Exchange Management Shell command: get-mailcontact | set-mailcontact

Exchange 2010:
 1) Import the contact objects using NNS ADix
2) Execute the following Exchange Management Shell command: get-mailcontact | update-recipient

.top

Distribution Groups

This topic describes how to create mail-enabled distribution groups with NNS ADix.

Note:
In order to create mail-enabled distribution groups, an Active Directory group object must be created. Please see
the following topic to get information about creating group objects with NNS ADix: NNS ADix - How to...Create Group Objects

Exchange 2000/2003

The following table contains a list of mandatory attributes which are required to create Exchange Server 2000/2003
mail-enabled distribution groups objects in Active Directory:

Attribute | Type | Description
mailNickname | single-valued | This attribute is the alias to the distribution group.

Note:
In Exchange 2000/2003 recipients are partially provisioned after their creation. The
Recipient Update Service (RUS) is responsible for setting the remaining attributes.

Example:

The following example mail-enables an existing group named 'group1' on Exchange 2000/2003:

path;mailNickName
LDAP://cn=group1,cn=groups,dc=dom,dc=com;group1

Exchange 2007/2010

Use the same attributes as for Exchange 2000/2003.

Note:
In Exchange 2007/2010 there is no RUS which is setting the remaining Exchange attributes automatically.
Therefore if you want to bulk import mail-enabled Exchange 2007/2010 distribution groups using NNS ADix,
perform the following steps:

Exchange 2007:
1) Import the group objects using NNS ADix
2) Execute the following Exchange Management Shell command: get-distributiongroup | set-distributiongroup

Exchange 2010:
 1) Import the group objects using NNS ADix
2) Execute the following Exchange Management Shell command: get-distributiongroup | update-recipient

.top

Copyright © 2011 by NNS - Nigl Network Solutions


NNS ADix - How to...Import or Export Terminal Services Related Attributes

This topic describes how to import or export Terminal Services/Remote Desktop Services related
attributes with NNS ADix.

General

Although attributes used for Terminal Services (Remote Desktop Services) are not stored in Active Directory, these attributes can be
managed using the Active Directory Users- and Computers tool (ADUC).

Note:
In fact the Terminal Services related user data is stored in an attribute called userData as some kind of
'binary blob with ASCII'. Therefore is very difficult to work with this attribute directly.

Import or Export Terminal Services (Remote Desktop Services) Related Attributes

With NNS ADix we provide a way to conveniently export/import Terminal Services related attributes, although these attributes are not part
of Active Directory.
The following table contains a list of the auxiliary attributes used for Terminal Services (Remote Desktop Services):

Attribute | Export/Import Behavior
AllowLogon | A value that specifies whether the user is allowed to log on to the RD Session Host server. The value is one if logon is allowed, and zero if logon is not allowed.
BrokenConnectionAction | A value that specifies the action to be taken when a Remote Desktop Services session limit is reached. The value is one if the client session should be terminated, and zero if the client session should be disconnected.
ConnectClientDrivesAtLogon | Connect client drives at logon. The value is one if client drives should be connected, and zero if client drives should not be disconnected.
ConnectClientPrintersAtLogon | A value that specifies whether to reconnect to mapped client printers at logon. The value is one if reconnection is enabled, and zero if reconnection is disabled.
DefaultToMainPrinter | A value that specifies whether to print automatically to the client's default printer. The value is one if printing to the client's default printer is enabled, and zero if it is disabled.
EnableRemoteControl | A value that specifies whether to allow remote observation or remote control of the user's Remote Desktop Services session. Possible values: 0: Disable Remote Control 1: Enabled, Require User’s Permission, Interact 2: Enabled, NO Require User’s Permission, Interact 3: Enabled, Require User’s Permission, View ONLY 4: Enabled, NO Require User’s Permission, View ONLY
MaxConnectionTime | The maximum duration of the Remote Desktop Services session, in minutes. After the specified number of minutes have elapsed, the session can be disconnected or terminated.
MaxDisconnectionTime | The maximum amount of time, in minutes, that a disconnected Remote Desktop Services session remains active on the RD Session Host server. After the specified number of minutes have elapsed, the session is terminated.
MaxIdleTime | The maximum amount of time that the Remote Desktop Services session can remain idle, in minutes. After the specified number of minutes has elapsed, the session can be disconnected or terminated.
ReconnectionAction | The action performed when reconnecting to an existing Remote Desktop Services session. Possible Values: 0: Allow reconnect from any client 1: Allow reconnect from ONLY from the originating client
TerminalServicesHomeDirectory | The root directory for the user. Each user on an RD Session Host server has a unique root directory. This ensures that application information is stored separately for each user in a multiuser environment.
TerminalServicesHomeDrive | The root drive for the user. In a network environment, this property is a string that contains a drive specification (a drive letter followed by a colon) to which the UNC path specified in the TerminalServicesHomeDirectory property is mapped.
TerminalServicesInitialProgram | The path and file name of the application that the user wants to start automatically when the user logs on to the RD Session Host server.
TerminalServicesProfilePath | The roaming or mandatory profile path to be used when the user logs on to the RD Session Host server.
TerminalServicesWorkDirectory | The working directory path for the user.

Simply use the attributes mentioned above to import or export Terminal Services related attributes.

Note:
In order to export or import Terminal Services (Remote Desktop Services) related attributes, you must either install the Remote Server
Administration Tools (RSAT, prior ADMINPACK) or register the DLL 'tsuserex.dll' on the computer where you are running NNS ADix.
Use the following command to register the DLL tsuserex.dll: regsvr32 tsuserex.dll.
Please take in mind that every OS has it's 'own' 'tsuserex.dll', so make sure that you use the right DLL for the OS you are using.

Copyright © 2011 by NNS - Nigl Network Solutions


NNS ADix - How to...Import or Export Pictures

This topic describes how to import or export pictures with NNS ADix.

General

Pictures can be stored in Active Directory using the following attributes:

Attribute | Implementations | ADS Type | Size
thumbnailPhoto | Windows Server 2000 and higher | ADSTYPE_OCTET_STRING, single-valued | 0-102400 bytes
thumbnailLogo | Windows Server 2000 and higher | ADSTYPE_OCTET_STRING, single-valued | 0-32767 bytes
jpegPhoto | Windows Server 2003 and higher | ADSTYPE_OCTET_STRING, multi-valued | unlimited
photo | Windows Server 2003 and higher | ADSTYPE_OCTET_STRING, multi-valued | unlimited

Various applications can use these attributes to display or store pictures.

Note:
For example Outlook 2010 uses the attribute thumbnailPhoto to display a thumbnail photo of a recipient in
the Address Book/GAL.

Import or Export Pictures

With NNS ADix we provide a way to conveniently import or export pictures.
The following table contains a list of the auxiliary attributes used for picture export/import:

Attribute | Export Behavior | Import Behavior
adixThumbnailPhoto | A thumbnail photo stored as octet string. Converts the octet string stored in the Active Directory attribute thumbnailPhoto to the JPEG-format and saves the JPEG-file to the export path used for the current export operation. The file will be called [name]_thumbnailPhoto.jpg. | The full path to a picture-file. Converts the picture-file to an octet string and saves this octet string to the Active Directory attribute thumbnailPhoto.
adixThumbnailLogo | A thumbnail logo stored as octet string. Converts the octet string stored in the Active Directory attribute thumbnailLogo to the JPEG-format and saves the JPEG-file to the export path used for the current export operation. The file will be called [name]_thumbnailLogo.jpg. | The full path to a JPEG-file. Converts the picture-file to an octet string and saves this octet string to the Active Directory attribute thumbnailLogo.
adixJpegPhoto | Photos stored as octet strings. Converts the octet strings stored in the Active Directory attribute jpegPhoto to the JPEG-format and saves the JPEG-file to the export path used for the current export operation. The file will be called [name]_jpegPhoto[n].jpg. | The full path to one or more picture-files. Converts the picture-files to octet strings and saves this octet strings to the Active Directory attribute jpegPhoto.
adixPhoto | Photos stored as octet strings. Converts the octet strings stored in the Active Directory attribute Photo to the JPEG-format and saves the JPEG-file to the export path used for the current export operation. The file will be called [name]_Photo[n].jpg. | The full path to one or more picture-files. Converts the picture-files to octet strings and saves this octet strings to the Active Directory attribute Photo.

Simply use the attributes mentioned above to import or export pictures.

Note:
We support the import of JPEG-, PNG- or GIF-formatted pictures. The format used for picture export is always JPEG.

Note:
You can also import or export pictures using the Active Directory attributes directly, but using these attributes means to use or to get
octet strings. Using the auxiliary attributes enables you to use or to get JPEG-files which is more convenient.

Example:

The following example imports a thumbnail photo based on the file 'c:\data\j.doe.jpg' for an user named 'j.doe':

path;adixThumbnailPhoto
LDAP://cn=j.doe,cn=users,dc=dom,dc=com;c:\data\j.doe.jpg

Copyright © 2011 by NNS - Nigl Network Solutions


NNS ADix - Appendix

The appendix provides some extra information that will help you to successfully export or import
Active Directory objects.

This section contains the following topics:

  • Appendix A: Valid Values for Attribute 'groupType': Contains a table of valid values for the attribute 'grouptype'
  • Appendix B: Valid Values for Attribute 'userAccountControl': Contains a table of valid values for the attribute 'userAccountControl'
  • Appendix C: LDAP Search Filters: Describes how to use LDAP search filters
  • Appendix D: Object Classes and Mandatory Attributes: Contains a table of object classes and their corresponding mandatory attributes
  • Appendix E: Updating Group Membership: Contains information about updating the group membership
  • Appendix F: NNS ADix Auxiliary Attributes: Describes the purpose and use of NNS ADix Auxiliary Attributes


NNS ADix - Appendix A: Valid Values for Attribute 'groupType'

If you want to create an Active Directory group, you must specify the group scope and
the group type of the group. You can specify the group type using the attribute 'groupType'.

The following table contains valid values this attribute:

Group Scope | Group Type | Value
Domain local | Security | -2147483644
Domain local | Distribution | 4
Global | Security | -2147483646;
Global | Distribution | 2
Universal | Security | -2147483640
Universal | Distribution | 8


NNS ADix - Appendix B: Valid Values for Attribute 'userAccountControl'

The values or flags for the attribute 'userAccountControl' are cumulative.
E.g. to disable a user account object, set the userAccountControl attribute to 0x0202 (0x002 + 0x0200).
You can also use decimal values. The decimal value for the example above is 514 (2 + 512).

The following table contains valid values this attribute:

Property Flag | Hexadecimal Value | Decimal Value
SCRIPT | 0x0001 | 1
ACCOUNTDISABLE | 0x0002 | 2
HOMEDIR_REQUIRED | 0x0008 | 8
LOCKOUT | 0x0010 | 16
PASSWD_NOTREQD | 0x0020 | 32
PASSWD_CANT_CHANGE | 0x0040 | 64
ENCRYPTED_TEXT_PWD_ALLOWED | 0x0080 | 128
TEMP_DUPLICATE_ACCOUNT | 0x0100 | 256
NORMAL_ACCOUNT | 0x0200 | 512
INTERDOMAIN_TRUST_ACCOUNT | 0x0800 | 2048
WORKSTATION_TRUST_ACCOUNT | 0x1000 | 4096
SERVER_TRUST_ACCOUNT | 0x2000 | 8192
DONT_EXPIRE_PASSWORD | 0x10000 | 65536
MNS_LOGON_ACCOUNT | 0x20000 | 131072
SMARTCARD_REQUIRED | 0x40000 | 262144
TRUSTED_FOR_DELEGATION | 0x80000 | 524288
NOT_DELEGATED | 0x100000 | 1048576
USE_DES_KEY_ONLY | 0x200000 | 2097152
DONT_REQ_PREAUTH | 0x400000 | 4194304
PASSWORD_EXPIRED | 0x800000 | 8388608
TRUSTED_TO_AUTH_FOR_DELEGATION | 0x1000000 | 16777216

Note:
You cannot set some of the values on a user or computer object, because these values
can be set or reset only by the directory service.

Property Flag Description

  • SCRIPT - The logon script will be run
  • ACCOUNTDISABLE - The user account is disabled
  • HOMEDIR_REQUIRED - The home folder is required
  • PASSWD_NOTREQD - No password is required
  • PASSWD_CANT_CHANGE - The user cannot change the password. This is a permission on the user's object
  • ENCRYPTED_TEXT_PASSWORD_ALLOWED - The user can send an encrypted password.
  • TEMP_DUPLICATE_ACCOUNT - This is an account for users whose primary account is in another domain.
    This account provides user access to this domain, but not to any domain that trusts this domain.
    This is sometimes referred to as a local user account.
  • NORMAL_ACCOUNT - This is a default account type that represents a typical user.
  • INTERDOMAIN_TRUST_ACCOUNT - This is a permit to trust an account for a system domain that trusts other domains.
  • WORKSTATION_TRUST_ACCOUNT - This is a computer account for a computer that is running Microsoft Windows NT 4.0 Workstation,
    Microsoft Windows NT 4.0 Server, Microsoft Windows 2000 Professional, or Windows 2000 Server and is a member of this domain.
  • SERVER_TRUST_ACCOUNT - This is a computer account for a domain controller that is a member of this domain.
  • DONT_EXPIRE_PASSWD - Represents the password, which should never expire on the account.
  • MNS_LOGON_ACCOUNT - This is an MNS logon account.
  • SMARTCARD_REQUIRED - When this flag is set, it forces the user to log on by using a smart card.
  • TRUSTED_FOR_DELEGATION - When this flag is set, the service account (the user or computer account) under which a service runs
    is trusted for Kerberos delegation. Any such service can impersonate a client requesting the service. To enable a service for
    Kerberos delegation, you must set this flag on the userAccountControl property of the service account.
  • NOT_DELEGATED - When this flag is set, the security context of the user is not delegated to a service even if the service account
    is set as trusted for Kerberos delegation.
  • USE_DES_KEY_ONLY - (Windows 2000/Windows Server 2003) Restrict this principal to use only Data Encryption Standard (DES)
    encryption types for keys.
  • DONT_REQUIRE_PREAUTH - (Windows 2000/Windows Server 2003) This account does not require Kerberos pre-authentication for logging on.
  • PASSWORD_EXPIRED - (Windows 2000/Windows Server 2003) The user's password has expired.
  • TRUSTED_TO_AUTH_FOR_DELEGATION - (Windows 2000/Windows Server 2003) The account is enabled for delegation. This is a
    security-sensitive setting. Accounts with this option enabled should be tightly controlled. This setting allows a service that runs under
    the account to assume a client's identity and authenticate as that user to other remote servers on the network.

For more information regarding the 'userAccountControl' attribute, see...

  • Microsoft KB305144 - How to use the UserAccountControl flags to manipulate user account properties


NNS ADix - Appendix C: LDAP Search Filters

NNS ADix supports LDAP search filters as defined in RFC2254.

The following table lists some examples of LDAP search filters:

Search Filter | Description
(objectClass=*) | Returns all objects.
(&(objectCategory=person)(objectClass=user)(!cn=j.doe)) | Returns all user objects but "j.doe".
(sn=do*) | Returns all objects with a surname starting with "do"
(&(objectCategory=person)(objectClass=contact)(|(sn=doe)(sn=miller))) | Returns all contacts with a surname equal to "Doe" or "Miller".

These filters are using one of the following formats:

<filter>=(<attribute><operator><value>)

or

(<operator><filter1><filter2>)

Operators

The following table lists frequently used search filter operators:

Logical Operator | Description
= | Equal to
~= | Approximately equal to
<= | Lexicographically less than or equal to
>= | Lexicographically greater than or equal to
& | AND
| | OR
! | NOT

Wildcards

You can also add wildcards and conditions to an LDAP search filter.
The following examples are showing substrings that can be used to search the directory:

Get all entries:

(objectClass=*)

Get entries containing "john" somewhere in the common name (cn):

(cn=*john*)

Get entries with a common name greater than or equal to "john":

(cn>='john')

Get all users with the attribute 'email' set:

(&(objectClass=user)(email=*))

Get all users with the attribute 'email' set and a surname equal to "doe":

(&(sn=doe)(objectClass=user)(email=*))

Get all user entries with a common name that starts with "john", "wil", or "andr*":

(&(objectClass=user)(|(cn=john*)(cn=wil*)(cn=andr*)))

Get all objects with an empty attribute 'email':

(!(email=*))

Special Characters

If any of the following special characters must appear in the search filter as literals,
they must be replaced by the listed escape sequence.

ASCII Character | Escape Sequence Substitute
* | \2a
( | \28
) | \29
\ | \5c
NUL | \00
/ | \2f

In addition, arbitrary binary data may be represented using the escape sequence syntax by encoding each
byte of binary data with the backslash (\) followed by two hexadecimal digits.
For example, the four-byte value 0x00000004 is encoded as \00\00\00\04 in a filter string.

For more information regarding LDAP search filters, see...

  • Platform SDK: Active Directory Service Interfaces - LDAP Search Filters
  • Platform SDK: Active Directory Service Interfaces - LDAP Dialect


NNS ADix - Appendix D: Object Classes and Mandatory Attributes

In order to create Active Directory objects, the import file must contain the appropriate object class
for every object to import. Further the import file must contain the appropriate mandatory attributes.

The following table contains a list of default object classes and their mandatory attributes used by NNS ADix:

Object Class | Mandatory Attributes
addressBookContainer | displayName
computer | sAMAccountName
contact | cn
container | cn
group | sAMAccountName;groupType
INetOrgPerson | sAMAccountName
licenseSiteSettings | adixMan
msExchRecipientPolicy | adixMan
nTDSSiteSettings | adixMan
organizationalUnit | ou
printQueue | printerName;serverName;shortServerName;uNCName;versionNumber
serverContainer | adixMan
site | adixMan
subnet | adixMan
user | sAMAccountName
volume | uNCName

These defintions are stored in the NNS ADix configuration file.
If you need more object classes, you can extend extend the object class definitions by adding new values
using the Object Class Definition dialog.

Every object class definition in must contain at least one mandatory attribute. NNS ADix does not allow empty
object class definitions. In order to create object classes which do not require mandatory attributes (e.g. 'subnet'),
use the auxiliary attribute 'adixMan'.

Note:
Creating objects with NNS ADix is a 2-step procedure:
1) The creation of the object with all mandatory attributes defined by the object settings in the registry
2) Update of the new object with the remaining attributes set in the import file

Related Help Topics:

  • Using Object Class Definitions


NNS ADix - Appendix E: Updating Group Membership

In order to update the group membership of an Active Directory object,
provide either the attribute member or the attribute memberOf in your import file.

Using the Attribute 'member' to Update the Group Membership

The attribute member is used for objects of the object class group and contains
the distinguished names of all group members.

  • Update behavior:
    Group members provided in an import file are added to existing group members unless you enable the option
    Clear the current group members of an object (attribute 'member') before importing the new group members
    during an AD import operation. With this option enabled,
    the attribute member will be first cleared and then the members provided in the import file will be added to the
    member-attribute of the current group object.

Note:
If you want to create groups and add members to the groups or use group nesting, we recommend to...
1) Create all groups and potential group members in one step
2) Update the attribute member with all group members in another step
Doing so will avoid the possibility that some group members cannot be added because they are not
already created. This can be especially the case if you use multi-threading for AD import.

  • Attribute format:
    The attribute member can be either formatted as distinguished name (CN=j.doe,CN=users,DC=dom,DC=com) or as
    sAMAccountName/pre-Windows 2000 name (jdoe).
    Depending on the format you use in your import file, you must either enable or disable the import option
    Use the pre-Windows 2000 logon name (sAMAccountName) when updating group membership.

Note:
Only pre-Windows 2000 logon names of objects that are residing in the same domain as the currently
logged on user who is performing the AD Import operation can be resolved.
Therefore we recommend to only select this option if you need the pre-Windows 2000 logon names
instead of the distinguished names.

Using the Attribute 'memberOf' to Update the Group Membership

The attribute memberOf is used for all object classes that can be member of a group. It contains the distinguished
names of all groups where the object is a member of.

  • Update behavior:
    Group provided in an import file are added to existing groups unless you enable the option
    Clear the current group membership of an object (attribute 'member') before importing the new group membership
    during an AD import operation. With this option enabled,
    the attribute memberOf will be first cleared and then the groups provided in the import file will be added to the
    memberOf-attribute of the current object.

Note:
If you want to create objects and add groups to the memberOf-attribute or use group nesting, we recommend to...
1) Create all groups in one step
2) Update the attribute memberOf with all groups in another step
Doing so will avoid the possibility that some group cannot be added because they are not
already created. This can be especially the case if you use multi-threading for AD import.

Note:
Actually the attribute memberOf is the back-link attribute for the attribute member. Therefore the
Directory Service maintains this attribute.
If you use the attribute memberOf in your import file, actually the current object is added to the group
where the object should be a member of. The attribute memberOf cannot be updated directly.
As this operation is time consuming, we recommend to use the attribute member wherever possible to update group membership.

  • Attribute format:
    The attribute memberOf can be either formatted as distinguished name (CN=group1,CN=users,DC=dom,DC=com) or as
    sAMAccountName/pre-Windows 2000 name (group1).
    Depending on the format you use in your import file, you must either enable or disable the import option
    Use the pre-Windows 2000 logon name (sAMAccountName) when updating group membership.

Note:
Only pre-Windows 2000 logon names of objects that are residing in the same domain as the currently
logged on user who is performing the AD Import operation can be resolved.
Therefore we recommend to only select this option if you need the pre-Windows 2000 logon names
instead of the distinguished names.


NNS ADix - Appendix F: Auxiliary Attributes

NNS ADIx auxiliary attributes are mostly not part of the Active Directory schema, but they can be used in import
files or when exporting objects to perform special tasks like exporting the last time when a user logged on to the
domain.

The following table contains a list of the auxiliary attributes used in NNS ADix:

Attribute | Export Behavior | Import Behavior
class | Represents the object class of the exported object. This attribute will be only exported if the option Export the object class... is selected. | Is required if a new object should be created.
path | Represents the object path of the exported object. This attribute will be only exported if the option Export the object path... is selected. | This attribute is always required when creating new objects. If you want to update existing objects, you can use this attribute to locate the object which should be updated.
userPassword | The user's password in UTF-8 format. This is a write-only attribute in Active Directory, so user passwords cannot be exported. | This attribute will be used to set passwords.
lastDomainLogon | Used to determine the last time a user logged on to a domain. To use this attribute in your export operation... - add lastDomainLogon to the list of attributes for which a Large Integer to Date String Conversion should be performed - select this attribute for export | N/A
adixMan | N/A | The creation of some object types does not require to set mandatory attributes, because all mandatory attributes will be set by the Directory Service automatically. In contrast NNS ADix requires that every object class definition must have at least one mandatory attribute set. Therefore the attribute adixMan is used as a placeholder attribute and will be skipped during the import process. The value provided for this attribute does not matter.
adixDel | N/A | This attribute is required for object deletion. Set the value of this attribute to 'DELOBJ' to delete a single object or set the value to 'DELTREE' to delete an entire object tree.
parentPath | Represents the object's parent path | N/A
pwdCantChange | Returns '$True' if the user account control option 'User cannot change password' is set, otherwise '$False' will be returned. | Set the value of this attribute to '$True' if the user account control option 'User cannot change password' should be enabled, otherwise set the value to '$False'
protectObjectFromDeletion | N/A | In Windows Server 2008 and later you can set an option called 'Protect object from accidental deletion' (ADUC->Object Properties->Object-Tab). To set or unset this option with NNS ADix, set the value of this attribute to '$True' if the specified object should be protected from accidental deletion, otherwise set the value to '$False'.
adixThumbnailPhoto | A thumbnail photo stored as octet string. Converts the octet string stored in the Active Directory attribute thumbnailPhoto to the JPEG-format and saves the JPEG-file to the export path used for the current export operation. The file will be called [name]_thumbnailPhoto.jpg. | The full path to a picture-file. Converts the picture-file to an octet string and saves this octet string to the Active Directory attribute thumbnailPhoto.
adixThumbnailLogo | A thumbnail logo stored as octet string. Converts the octet string stored in the Active Directory attribute thumbnailLogo to the JPEG-format and saves the JPEG-file to the export path used for the current export operation. The file will be called [name]_thumbnailLogo.jpg. | The full path to a picture-file. Converts the JPEG-file to an octet string and saves this octet string to the Active Directory attribute thumbnailLogo.
adixJpegPhoto | Photos stored as octet strings. Converts the octet strings stored in the Active Directory attribute jpegPhoto to the JPEG-format and saves the JPEG-file to the export path used for the current export operation. The file will be called [name]_jpegPhoto[n].jpg. | The full path to one or more picture-files. Converts the picture-files to octet strings and saves this octet strings to the Active Directory attribute jpegPhoto.
adixPhoto | Photos stored as octet strings. Converts the octet strings stored in the Active Directory attribute Photo to the JPEG-format and saves the JPEG-file to the export path used for the current export operation. The file will be called [name]_Photo[n].jpg. | The full path to one or more picture-files. Converts the picture-files to octet strings and saves this octet strings to the Active Directory attribute Photo.

Terminal Services (Remote Desktop Services) Attributes

Although attributes used for Terminal Services (Remote Desktop Services) are not stored in Active Directory, these attributes can be
managed using the Active Directory Users- and Computers tool (ADUC).

Note:
In fact the Terminal Services related user data is stored in an attribute called userData as some kind of
'binary blob with ASCII'. Therefore is very difficult to work with this attribute directly.

With NNS ADix we provide a way to conveniently export/import Terminal Services related attributes, although these attributes are not part
of Active Directory.
The following table contains a list of the auxiliary attributes used for Terminal Services (Remote Desktop Services):

Attribute | Export/Import Behavior
AllowLogon | A value that specifies whether the user is allowed to log on to the RD Session Host server. The value is one if logon is allowed, and zero if logon is not allowed.
BrokenConnectionAction | A value that specifies the action to be taken when a Remote Desktop Services session limit is reached. The value is one if the client session should be terminated, and zero if the client session should be disconnected.
ConnectClientDrivesAtLogon | Connect client drives at logon. The value is one if client drives should be connected, and zero if client drives should not be disconnected.
ConnectClientPrintersAtLogon | A value that specifies whether to reconnect to mapped client printers at logon. The value is one if reconnection is enabled, and zero if reconnection is disabled.
DefaultToMainPrinter | A value that specifies whether to print automatically to the client's default printer. The value is one if printing to the client's default printer is enabled, and zero if it is disabled.
EnableRemoteControl | A value that specifies whether to allow remote observation or remote control of the user's Remote Desktop Services session. Possible values: 0: Disable Remote Control 1: Enabled, Require User’s Permission, Interact 2: Enabled, NO Require User’s Permission, Interact 3: Enabled, Require User’s Permission, View ONLY 4: Enabled, NO Require User’s Permission, View ONLY
MaxConnectionTime | The maximum duration of the Remote Desktop Services session, in minutes. After the specified number of minutes have elapsed, the session can be disconnected or terminated.
MaxDisconnectionTime | The maximum amount of time, in minutes, that a disconnected Remote Desktop Services session remains active on the RD Session Host server. After the specified number of minutes have elapsed, the session is terminated.
MaxIdleTime | The maximum amount of time that the Remote Desktop Services session can remain idle, in minutes. After the specified number of minutes has elapsed, the session can be disconnected or terminated.
ReconnectionAction | The action performed when reconnecting to an existing Remote Desktop Services session. Possible Values: 0: Allow reconnect from any client 1: Allow reconnect from ONLY from the originating client
TerminalServicesHomeDirectory | The root directory for the user. Each user on an RD Session Host server has a unique root directory. This ensures that application information is stored separately for each user in a multiuser environment.
TerminalServicesHomeDrive | The root drive for the user. In a network environment, this property is a string that contains a drive specification (a drive letter followed by a colon) to which the UNC path specified in the TerminalServicesHomeDirectory property is mapped.
TerminalServicesInitialProgram | The path and file name of the application that the user wants to start automatically when the user logs on to the RD Session Host server.
TerminalServicesProfilePath | The roaming or mandatory profile path to be used when the user logs on to the RD Session Host server.
TerminalServicesWorkDirectory | The working directory path for the user.

Note:
In order to export or import Terminal Services (Remote Desktop Services) related attributes, you must either install the Remote Server
Administration Tools (RSAT, prior ADMINPACK) or register the DLL 'tsuserex.dll' on the computer where you are running NNS ADix.
Use the following command to register the DLL tsuserex.dll: regsvr32 tsuserex.dll.
Please take in mind that every OS has it's 'own' 'tsuserex.dll', so make sure that you use the right DLL for the OS you are using.