Bulk rename of user accounts in Active Directory

Due to a change to the naming policy, I need to rename around 1000 user
accounts in active directory (Windows Server 2003, Native Mode)
The user name (Name & CN) should be like the samAccountName attribute.

I've tried to do it with LDIFDE but I got an error message that I can't
rename the user account because "The attribute is owned by the system".

I can live with a text file that has all the user details (CSV?) because
this is a one time job and I rather be safe then sorry and I think I'd
rather not let the script run fully automatically.

Any ideas on how to do a bulk rename of user account in active directory
through batch/script?

Amihai,
You can use a variety of methods, but keep in mind that changing the CN
is effectively a move, not an attribute change. So if you need to
change a user CN, you need to 'move' that object, even if it's staying
in the same container.

In VBscript, this would be done through something like this:
set objCont = GetObject("LDAP://" & ParentDN)
objCont.MoveHere "LDAP://cn=" & UserOldName & "," & ParentDN, "cn=" &
UserNewName
set objUser = GetObject("LDAP://cn=" & UserNewName & "," & ParentDN)
objUser.Put "name", UserNewName
objUser.SetInfo

Bill

The change type for LDIF for a CN change (assuming the CN is the RDN attribute
which in the case of users it is...) is changetype:modrdn. This is because it is
an object rename, not a normal attribute change.

If using ADSI scripting, they consider it a move so you use the method movehere.

If using LDAP API you want to use ldap_rename_ext.

joe


--
Joe Richards Microsoft MVP Windows Server Directory Services
www.joeware.net


Amihai Bareket wrote:
> Due to a change to the naming policy, I need to rename around 1000 user
> accounts in active directory (Windows Server 2003, Native Mode)
> The user name (Name & CN) should be like the samAccountName attribute.
>
> I've tried to do it with LDIFDE but I got an error message that I can't
> rename the user account because "The attribute is owned by the system".
>
> I can live with a text file that has all the user details (CSV?) because
> this is a one time job and I rather be safe then sorry and I think I'd
> rather not let the script run fully automatically.
>
> Any ideas on how to do a bulk rename of user account in active directory
> through batch/script?
>
>