Synchronize with Active Directory Domain Services

Applies To: Windows Server 2008

You can use adamsync command line tool to synchronize data from an Active Directory Domain Services (AD DS) forest to a configuration set of an Active Directory Lightweight Directory Services (AD LDS) instance. There are two prerequisites before you can synchronize data from an AD DS forest to the configuration set of an AD LDS instance:

1. The schema objects in the AD LDS instance must match the schema objects in the AD DS forest.

2. The schema in the AD LDS instance must be extended for schema objects that are required by the adamsync command line tool.

Matching the schema objects in the AD LDS instance with the schema objects in the AD DS forest

To ensure that your AD LDS schema matches the AD DS schema, use AD DS/LDS Schema Analyzer to create an LDIF file that will contain the target schema elements, and then import this LDIF file into your base AD LDS schema by using the ldifde command.

Membership in the Administrators group of the AD LDS instance is the minimum required to complete this procedure. By default, the security principal that you specify as the AD LDS administrator during AD LDS setup becomes a member of the Administrators group in the configuration partition.

To create an LDIF file with AD DS/LDS Schema Analyzer

1. To open AD DS/LDS Schema Analyzer, at the command prompt, change the directory to %windir%\ADAM, type the following command, and then press ENTER:

   adschemaanalyzer

2. To load a target schema, click File, and then click Load target schema, and then do one of the following:

   • To load the domain Active Directory schema as the target schema, in the dialog box, type your user name, password, and domain, and then click OK.

   • To load a different schema (such as the schema of an Active Directory forest or an another LDAP-compliant directory), in the dialog box, type the server name and port of the directory containing the target schema, type your user name, password, and domain as needed, and then click OK.

3. To load the schema of your AD LDS instance as the base schema, click File, click Load base schema, and then in Server[:port], type the server name and port of the AD LDS instance.

4. In the dialog box, click OK.

5. Click Tools, click Options, and on the LDIF generation tab, click Update with references to new and present elements.

6. Since later you plan to synchronize data by using adamsync, click Schema, and then click Mark all non-present elements as included.

7. To create the LDIF file, click File, and then click Create LDIF file. To save the created LDIF file, type in the file name and save it at an appropriate location. For example, C:\Windows\ADAM\Differences.LDIF

8. To import the LDIF file into the AD LDS instance in order to update the AD LDS schema to match the AD DS schema, open the created LDIF file, copy the ldifde command created by the AD DS/LDS Schema Analyzer, (for example, ldifde –i –u –f differences.ldf –s server:port –b username domain password –j . –c “cn=Configuration, dc=X” #configurationNamingContext) and paste it into the command prompt. Edit the ldifde command to reflect your AD LDS server name and port, and then press ENTER.

Extending the AD LDS instance schema for objects that are required by adamsync

You can use the following procedure to extend the AD LDS schema to include schema objects that are required by the adamsync command line tool.

Membership in the Administrators group of the AD LDS instance is the minimum required to complete this procedure. By default, the security principal that you specify as the AD LDS administrator during AD LDS setup becomes a member of the Administrators group in the configuration partition.

To extend the AD LDS instance schema to include objects that are required by adamsync

1. At the command prompt, change the directory to %windir%\ADAM, type the following command, and then press ENTER:

   ldifde -i -f MS-AdamSyncMetadata.ldf -s <server>:<port> -c CN=Configuration,DC=X #ConfigurationNamingContext

   For example, to extend the AD LDS schema on a local server, type the following command, and then press ENTER:

   ldifde -i -f MS-AdamSyncMetadata.ldf -s localhost:50000 -c CN=Configuration,DC=X #ConfigurationNamingContext

2. To open the configuration file MS-AdamSyncConf.xml in a text editor (Notepad.exe) and modify it with the appropriate parameters, type the following command, and then press ENTER:

   notepad MS-AdamSyncConf.xml

3. In Notepad, make the following changes to the contents of the configuration file:

   • Replace the value of <source-ad-name> with the name of the source AD DS domain controller, for example, <source-ad-name>SeattleDC1</source-ad-name>.

   • Replace the value of <source-ad-partition> with the distinguished name of the source domain, for example, <source-ad-partition>dc=fabrikam,dc=com</source-ad-partition>.

   • Replace the value of <source-ad-account> with the name of an account in the Domain Admins group of the source domain, for example, <source-ad-account>administrator</source-ad-account>.

   • Replace the value of <account-domain> with the fully qualified Domain Name System (DNS) name of the source domain, for example, <account-domain>fabrikam.com</account-domain>.

   • Replace the value of <target-dn> with the name of the partition of the target AD LDS instance, for example, <target-dn>DC=Microsoft,DC=US</target-dn>.

  - Replace the value of \<base-dn\> with the base distinguished name of the container in the source domain where you want the search for synchronizing objects to start, for example, \<base-dn\>ou=users,dc=fabrikam,dc=com\</base-dn).  
      
  - Modify the query filter (the default being \<object-filter\>(objectClass=\*)\</object-filter\>), depending on what objects you want to synchronize.  
      

4. In Notepad, on the File menu, click Save As, type a new name for the file, click Save, and then close Notepad.

5. To install the modified configuration file, at the command prompt, type the following command, substituting the file name that was used in the procedure above for .xml_file, and then press ENTER:

   adamsync /install <server>:<port> .xml_file

   For example,

   adamsync /install localhost:50000 %windir%\ADAM\MS-AdamSyncConf.xml

Synchronizing AD DS data to an AD LDS instance

You can use the following procedure to synchronize the data from your AD DS data to the AD LDS configuration set.

Membership in the Administrators group of the AD LDS instance is the minimum required to complete this procedure. By default, the security principal that you specify as the AD LDS administrator during AD LDS setup becomes a member of the Administrators group in the configuration partition.

To synchronize AD DS forest data to an AD LDS instance

1. At a command prompt, type the following command, and then press ENTER:

   adamsync /sync <server>:<port> ADLDS_configuration_dn /log

   Replace ADLDS_configuration_dn with the distinguished name of the AD LDS namespace where you saved the configuration MS-AdamSyncConf.xml file (or the value of target_dn in MS-AdamSyncConf.xml file). For example, adamsync /sync localhost:50000 DC=microsoft,DC=US” /log.

The following table contains the parameters for the preceding procedures and other commonly used adamsync parameters. For more information about adamsync parameters, at a command prompt, type adamsync /?, and then press ENTER.

• You must have Read or Dirsync access to the objects or partitions in the AD DS forest that you want to synchronize.

• You must have full control of an application directory partition on an AD LDS instance to run this command.

For more information, see Adamsync.