LOL! > I don't like the ds* tools, b/c they try to hide LDAP names ... > and thus create uncertainty and doubt when debugging something > where everyone could've learned the LDAP names. The level of > indirection, IMNHO was unnecessary.
Amen. This is one reason ds* tools are something I rarely if ever use as well. When I first heard about these things coming out I was like, hmm I won't have to work on adfind anymore... No such luck. > I'm not actually sure what "user" and "contact" expand to, > an objectClass or a more specific objectCategory? These are actually expanded fairly well (objectcat) + (objectcl). It is the multiple trips that is the pain, dsget does 2 trips for a single object by itself plus you obviously have the dsquery trip as well. Once to get the objectclass and if it is happy with that it goes back for the other attribs. joe -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Brett Shirley Sent: Monday, December 13, 2004 11:33 AM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] DSget Contacts in AD Maybe use tee, if dsget is killing the whole command line, it may give you the exact object at the end of the file ... finding tee.exe, excercise for the reader. It could be that dsquery doesn't handle paged searches, and you don't have more than 500 users, but you do have more than 500 contacts (IIRC users are contacts, as well as other stuff, soo this may make sense). Is the paged search limit default 500? Or am I remembering wrong, and it is 1000? I don't like the ds* tools, b/c they try to hide LDAP names ... and thus create uncertainty and doubt when debugging something where everyone could've learned the LDAP names. The level of indirection, IMNHO was unnecessary. Alternatively ... these commands: repadmin /showattr . "OU=companies,DC=domain,DC=com" /subtree /filter:"(objectClass=user)" /atts:displayName,mail,physicalDeliveryOfficeName,accountExpires repadmin /showattr . "OU=companies,DC=domain,DC=com" /subtree /filter:"(objectClass=contact)" /atts:displayName,mail,physicalDeliveryOfficeName,accountExpires I think will do something similar to these dsquery/dsget lines: > > > >dsquery user ou=companies,dc=domain,dc=com -limit 0 | dsget user > > > >-display -email -office -acctexpires > d:\temp\dsquery.txt > > > >dsquery contact ou=companies,dc=domain,dc=com -limit 1000 | dsget > > > >contact -display -email -office > d:\temp\dsquerycontacts.txt I'm not actually sure what "user" and "contact" expand to, an objectClass or a more specific objectCategory? But of course repadmin will not be in the dsget format ... if that is important to you. You will want to index objectClass in your AD. Repadmin won't however make 2 or more trips if necessary, so this will however be more efficient ... though that might not matter. This time, I'll give you help finding the command ... the best version of repadmin is definately in ADAM: http://www.microsoft.com/downloads/details.aspx?FamilyId=9688F8B9-1034-4EF6- A3E5-2A2A57B5C8E4&displaylang=en You want ADAMretailX86.exe. Extract the data to somewhere convienent, say "dir1". Then go into that dir1, and run "adamsetup /t:dir2". In dir2 is a good repadmin. Cheers, -BrettSh (msft) This message is AS IS, and I'm sure the advice above technically breaks EULAs, and soo I guess I should say I don't endorse that or something. But who really cares if you copy the tools out of the install package to where is convient for you. Or maybe it is supported I don't know. On Mon, 13 Dec 2004, Dan HINCKLEY wrote: > Without the pipe to dsget it does not choke. > > At 19:05 12/10/2004, you wrote: > >One thing that bothers me is that DSQUERY should have brought back > >all the entries and you should have been able to use it as expected. > >I'm trying to figure out why DSQUERY chokes on the amount. > > > > > >Can you verify that it's the amount that's causing it to choke? Can > >you run it without piping the results to dsget and see if you get the same results? > > > >Al > > > >-----Original Message----- > >From: [EMAIL PROTECTED] > >[mailto:[EMAIL PROTECTED] On Behalf Of joe > >Sent: Friday, December 10, 2004 12:14 PM > >To: [EMAIL PROTECTED] > >Subject: RE: [ActiveDir] DSget Contacts in AD > > > >How about > > > >Command | grep ">" > > > >Or do you mean the dn: string prefixing the dn being returned? > > > >If the latter, you can have it returned distinguishedname as one of > >the attributes and then use the command above but you will still get > >the attribute labels. If you just want DN strings, you can use the > >-dsq option but you won't get attributes output at all then. > > > > joe > > > > > > > >-----Original Message----- > >From: [EMAIL PROTECTED] > >[mailto:[EMAIL PROTECTED] On Behalf Of Dan HINCKLEY > >Sent: Friday, December 10, 2004 10:14 AM > >To: [EMAIL PROTECTED] > >Subject: RE: [ActiveDir] DSget Contacts in AD > > > >Any way to exclude the DN from the output? > > > >At 15:44 12/10/2004, you wrote: > > >C:\>adfind -b ou=companies,dc=domain,dc=com -f > > >"(&(objectcategory=Person)(objectClass=contact > > >))" cn createTimeStamp > > > > > >AdFind V01.17.00cpp Joe Richards ([EMAIL PROTECTED]) May 2004 > > > > > >Using server: wil-dc01.bbtnet.com > > > > > >dn:CN=Test User,CN=Users,DC=bbtnet,DC=com > > > >createTimeStamp: 20041210144136.0Z > > > >cn: Test User > > > > > > > > >1 Objects returned > > > > > > > > > > > >Specifying the attribute list tells ADFIND to return those attributes only. > > >In your case, you'd use displayname, mail, and > > >physicaldeliveryofficename for the attributes you want. > > > > > > > > >Al > > > > > >-----Original Message----- > > >From: [EMAIL PROTECTED] > > >[mailto:[EMAIL PROTECTED] On Behalf Of Dan > > >HINCKLEY > > >Sent: Friday, December 10, 2004 9:27 AM > > >To: [EMAIL PROTECTED] > > >Subject: RE: [ActiveDir] DSget Contacts in AD > > > > > >I had it set to 500 because for any limit size above that (0, or > > >1500, > > >etc.) it fails with that error. > > > > > >I've read through the ADfind docs and must not be alert enough to > > >see how to spec the attribs I want. How is it done? > > > > > >At 15:17 12/10/2004, you wrote: > > > >You may misunderstand ADFIND. It will allow you to specify the > > > >attribs you want vs. which one's you don't want last I checked. > > > > > > > >As for your DSQUERY command, why are you limiting to 1000 on the > > > >one that doesn't work? Why not leave it at 0 ? > > > > > > > >Al > > > > > > > >-----Original Message----- > > > >From: [EMAIL PROTECTED] > > > >[mailto:[EMAIL PROTECTED] On Behalf Of Dan > > > >HINCKLEY > > > >Sent: Friday, December 10, 2004 8:16 AM > > > >To: [EMAIL PROTECTED] > > > >Subject: [ActiveDir] DSget Contacts in AD > > > > > > > >I find DSget works like a charm retrieving user info like this: > > > > > > > >dsquery user ou=companies,dc=domain,dc=com -limit 0 | dsget user > > > >-display -email -office -acctexpires > d:\temp\dsquery.txt > > > > > > > >But when I try to retrieve more than about 500 contacts like this: > > > > > > > >dsquery contact ou=companies,dc=domain,dc=com -limit 1000 | dsget > > > >contact -display -email -office > d:\temp\dsquerycontacts.txt > > > > > > > >I get this error: > > > > > > > >dsget failed:Value for `Target object for this command' has > > > >incorrect format > > > > > > > >The Contacts folder has a series of subfolders and a few > > > >distribution groups mixed in; might they cause this? > > > > > > > >ADfind doesn't seem to give me the option to specify which fields > > > >I wnat to retrieve, only to exclude fields, and there are too > > > >many to do > > >that. > > > > > > > > > > > >++++++++++++++++++++++++++++++++++++++++++++++++++++++++ > > > >Dan Hinckley t: (41 22) 999 0183 > > > >Information Management Group f: (41 22) 999 0010 > > > >IUCN, The World Conservation Union e: [EMAIL PROTECTED] > > > >1196 Gland, Switzerland w: http://iucn.org/ > > > > > > > >List info : http://www.activedir.org/mail_list.htm > > > >List FAQ : http://www.activedir.org/list_faq.htm > > > >List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ > > > >List info : http://www.activedir.org/mail_list.htm > > > >List FAQ : http://www.activedir.org/list_faq.htm > > > >List archive: > > > >http://www.mail-archive.com/activedir%40mail.activedir.org/ > > > > > >List info : http://www.activedir.org/mail_list.htm > > >List FAQ : http://www.activedir.org/list_faq.htm > > >List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ > > >List info : http://www.activedir.org/mail_list.htm > > >List FAQ : http://www.activedir.org/list_faq.htm > > >List archive: > > >http://www.mail-archive.com/activedir%40mail.activedir.org/ > > > >List info : http://www.activedir.org/mail_list.htm > >List FAQ : http://www.activedir.org/list_faq.htm > >List archive: > >http://www.mail-archive.com/activedir%40mail.activedir.org/ > > > >List info : http://www.activedir.org/mail_list.htm > >List FAQ : http://www.activedir.org/list_faq.htm > >List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ > >List info : http://www.activedir.org/mail_list.htm > >List FAQ : http://www.activedir.org/list_faq.htm > >List archive: > >http://www.mail-archive.com/activedir%40mail.activedir.org/ > > List info : http://www.activedir.org/mail_list.htm > List FAQ : http://www.activedir.org/list_faq.htm > List archive: > http://www.mail-archive.com/activedir%40mail.activedir.org/ > List info : http://www.activedir.org/mail_list.htm List FAQ : http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/mail_list.htm List FAQ : http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
