Have You Heard This One-Liner?

By: Justin Grote

August 16, 2006 12:00 am

Reads: 149




The Identity Manager AD driver matches against eDir users on the basis of the userprincipalname. However, this is an optional attribute that not all users (especially ones created before Windows 2003) have.


Here’s a quick one-liner I whipped up in a few minutes for a customer. This will find all users in an Active Directory tree that don’t have a UserPrincipalName, get their SamAccountName, build a UPN off of that, and inject the new UPN’s into AD.

ldapsearch -xWZLLL -D "cn=Administrator,cn=users,dc=example,dc=com" -b
"dc=example,dc=com" -h myserver.example.com
'(&(objectclass=user)(!(userprincipalname=*)))' samaccountname | sed
'/sAMAccountName/s/$/\@example\.com/g' | sed
s/sAMAccountName/userPrincipalName/g | ldapmodify -xWZ -D
"cn=Administrator,cn=users,dc=example,dc=com" -h myserver.example.com
VN:F [1.9.22_1171]
Rating: 0.0/5 (0 votes cast)

Tags: , , ,
Categories: Uncategorized

Disclaimer: As with everything else at NetIQ Cool Solutions, this content is definitely not supported by NetIQ, so Customer Support will not be able to help you if it has any adverse effect on your environment.  It just worked for at least one person, and perhaps it will be useful for you too.  Be sure to test in a non-production environment.