LDAP - Error - Unable to open log file

Description:
It's a good idea to log the progress of a LDAP import/export to see what entities have successfully imported/exported and what entities are not. To enable logging, we need to use '-j' option in the command with a valid location where log files will be created.

Command:


ldifde -i -f export.ldif -s localhost -t 10389 -a "uid=admin,ou=system" secret -k -j c:\logs

Explanation:
-i = enables import (default is export)
-f = indicate import/export file. After -f user has to provide a valid file to import data from 
-s = server info. Value after -s is server info
-t = port info after the option
-a = execute the command using supplied distinguish name and password
-k = to ignore 'Constraint Violation' and 'Object Already Exists' errors. This is import specific       
       option.
-j = enable logging. Value after this option has to be a valid location

Log Location:
If log location is valid, the command will create two log files ldif.err and ldif.log. First one includes all the errors, second one is for more verbose information


Errors:
1. Log file location must follow -j
2. Unable to open log file

Solution of errors:
1. -j must follow with valid log location and need to make sure no file name
2. Need to make sure file name not provided as log location

LDAP - Error - A referral was returned from the server

Problem:
System throws below error-01 when try to execute command-01.

Error-01:Add error on line 2: Referral

The server side error is "A referral was returned from the server."

0 entries modified successfully.

An error has occurred in the program

Command-01:
ldifde /i /f schema.ldf /v /k /c "DC=development,DC=com" "dc=test,dc=com"


Cause:
1. The export file had different mapping where export was taken from another box but in the import command it specify 'development'


Solution:
1. Need to make sure export environment is correctly mentioned in import which is the first parameter for '-c' switch

Note:
1. DC values are comma separated
2. No space in between DCs

Resources:
1. http://support.microsoft.com/kb/276382
2. http://support.microsoft.com/kb/237677

LDAP - Error - Unwilling To Perform

Problem:
System throws below error-01 when try to execute command-01.

Error-01:

Unwilling To Perform
The server side error is "The modification was not permitted for security reasons."
0 entries modified successfully.
An error has occurred in the program

Command-01:
ldifde /i /f schema.ldf /v /k /c "DC=development,DC=nyc" "dc=sso,dc=test,dc=com"

Cause:
1. This problem may occur when try to import data that cannot be written to Active Directory

Solution:
1. Import data from Active Directory using filter and specify only those fields which are needed
Command-02: include fields using '/l field1,field2'
ldifde /f schema.ldf /v /l field1,field2

Command-03: exclude fields using '/o field1,field2'
ldifde /i /f schema.ldf /v /o field1,field2

2. Import data from Active Directory using parameter "/n" which will exclude all the binary fields
Command-04: 
ldifde /i /f schema.ldf /v /n

Notes:

1. To get more detail information about the error, below command can be used
   Command-05: 
   ldifde /i /f schema.ldf /v /k /c "DC= development,DC=nyc"  "dc=sso,dc=test,dc=com"  /j c:\ldiflog\
   'c:\ldiflog' folder has to exist
   
2. Few fields are required in Active Directory
1. distinguishedName or dn
2. objectclass
3. sAMAccountName
3. Few fields are optionalchangetype, accountExpires, codePage, cn, countryCode, displayName, instanceType, logonHours, distinguishedName, objectCategory, name, userAccountControl, uSNChanged, uSNCreated, whenChanged, whenCreated
4. Few fields cannot be imported
   badPasswordTime, badPwdCount, lastLogoff, lastLogon, logonCount, memberOf, objectGUID, objectSid, primaryGroupID, pwdLastSet, sAMAccountType
5. 
   

Resources:
1. http://support.microsoft.com/kb/276382
2. http://support.microsoft.com/kb/237677