Prerequisites:
Install the PowerShell Active Directory Module.
Install-WindowsFeature -Name “RSAT-AD-PowerShell” -IncludeAllSubFeature
The <domain\username> referenced in the following commands should be the same that is being used with the LDAP import tool.
Steps:
1. Use the "Get-ADForest" command to determine the Active Directory forest that is accessible and get a list of domains accessible in that forest:
Get-ADForest -Credential <domain\username> One of the values returned is named "Domains". Here is an example of what that might look like:
Domains : {subdomainB.mycompany.corp, subdomainA.mycompany.corp, mycompany.corp}
2. Next, use the "Get-ADDomains" command for each desired domain (listed in the previous result) to get the ldap "DistinguishedName" value for the domain.
Get-ADDomain -Credential <domain\username> -Identity <target domain from one of the Domains returned in the Get-ADForest result Example:
Get-ADDomain -Credential corp\myusername -Identity subdomainA.mycompany.corp
One of the values returned is named "DistinguishedName".
Example:
DistinguishedName : DC=subdomainA,DC=.mycompany,DC=corp
3. Next, using the "DistinguishedName" for the desired domain, use the "Get-ADObject" to get a list of the OUs and Containers in that domain that can be selected.
Get-ADObject -Filter 'ObjectClass -eq "organizationalUnit" -or ObjectClass -eq "container"' -SearchBase <"DistinguishedName" value from Get-ADDomain> -Server <target domain > -Credential <domain\username> Example:
Get-ADObject -Filter 'ObjectClass -eq "organizationalUnit" -or ObjectClass -eq "container"' -SearchBase "DC=subdomainA,DC=.mycompany,DC=corp" -Server subdomainA.mycompany.corp -Credential corp\myusername
The result will be a list of OUs and containers that should be selectable in LDAP Sync Service tool.
One of the values returned is named "DistinguishedName". Here is an example of what that might look like:
DistinguishedName : OU=TestOU,DC=.mycompany,DC=corp
4. If these are returning some of the desired OUs or containers which are expected to have users that are to be scanned, use the GetADUser command to get a list of users in one of the listed containers or OU.
Get-ADUser -Filter * -SearchBase <"DistinguishedName" OU/container value from Get-ADObject> -Server <target domain > -Credential <domain\username> Example:
Get-ADUser -Filter * -SearchBase "OU=TestOU,DC=.mycompany,DC=corp" -Server subdomainA.mycompany.corp -Credential corp\myusername
This should result in a list of AD User objects that the provided LDAP user has access to view in that OU along with some of their AD properties.
If using the above posershell commands does not result in a valid list of server, or OU/containers, or AD users, then the LDAP credentials that were provided do not appear to have the appropriate permissions and a different domain/user account should be used.
