Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2


Creates, modifies, and deletes directory objects on computers running Windows Server 2003 operating systems or Windows XP Professional. You can also use Ldifde to extend the schema, export Active Directory user and group information to other applications or services, and populate Active Directory with data from other directory services.


Ldifde [-i] [-f FileName] [-s ServerName] [-c String1 String2] [-v] [-j Path] [-t PortNumber] [-d BaseDN] [-r LDAPFilter] [-p Scope] [-l LDAPAttributeList] [-o LDAPAttributeList] [-g] [-m] [-n] [-k] [-a UserDistinguishedName Password] [-b UserName Domain Password] [-?]

  • -i
    Specifies import mode. If not specified, the default mode is export.
  • -f FileName
    Identifies the import or export file name.
  • -s ServerName
    Specifies the domain controller to perform the import or export operation. By default, Ldifde will run on the domain controller on which Ldifde is installed.
  • -c String1 String2
    Replaces all occurrences of String1 with String2. This is generally used when importing data from one domain to another and the distinguished name of the export domain (String1) needs to be replaced with that of the import domain (String2).
  • -v
    Sets verbose mode.
  • -j Path
    Sets the log file location. The default is the current path.
  • -t PortNumber
    Specifies a LDAP port number. The default LDAP port is 389. The global catalog port is 3268.
  • -d BaseDN
    Sets the distinguished name of the search base for data export.
  • -r LDAPFilter
    Creates a LDAP search filter for data export. For example, to export all users with a particular surname, you can use the following filter -r (and(objectClass=User)(sn=Surname))
  • -p Scope
    Sets the search scope. Search scope options are Base, OneLevel, or SubTree.
  • -l LDAPAttributeList
    Sets the list of attributes to return in the results of an export query. If this parameter is omitted, all attributes are returned.
  • -o LDAPAttributeList
    Sets the list of attributes to omit from the results of an export query. This is typically used when exporting objects from Active Directory and then importing them into another LDAP-compliant directory. If attributes are not supported by another directory, you can omit the attributes from the result set using this option.
  • -g
    Omits paged searches.
  • -m
    Omits attributes that only apply to Active Directory objects such as the ObjectGUID, objectSID, pwdLastSet and samAccountType attributes.
  • -n
    Omits export of binary values.
  • -k
    Ignores errors during the import operation and continues processing. The following is a complete list of ignored errors:

    • object is already a member of the group

    • object class violation (meaning the specified object class does not exist), if the object being imported has no other attributes

    • object already exists

    • constraint violation

    • attribute or value already exists

    • no such object

  • -a UserDistinguishedName Password
    Sets the command to run using the supplied UserDistinguishedName and Password. By default, the command will run using the credentials of the user currently logged on to the network.
  • -b UserName Domain Password
    Sets the command to run using the supplied UserName Domain Password. By default, the command will run using the credentials of the user currently logged on to the network.
  • -?
    Displays the command menu.
  • When creating the import file to use with the Ldifde command, use a changeType value to define the type of changes the import file will contain. The following changeType values are available:

    Value Description


    Specifies that new content is contained in the import file.


    Specifies that existing content has been modified in the import file.


    Specifies that content has been deleted in the import file.

The following is an example of an LDIF import file format using the add value.

DN: CN= SampleUser ,DC= DomainName

changetype: add

CN: SampleUser

description: DescriptionOfFile

objectClass: User

sAMAccountName: SampleUser


To retrieve only the distinguished name, common name, first name, surname, and telephone number for user objects in the fabrikam.com domain to a file named ldifde.txt in the c:\ldifde folder, run the following command:

Ldifde –d dc=fabrikam,dc=com –r (objectClass=User) -l distinguishedname,cn,givenname,sn,telephone

To selectively omit the object creation date and time and the object globally unique identifier (GUID), run the following command:

Ldifde –d dc=fabrikam,dc=com –r (objectClass=User) -o whenCreated,objectGUID


For more examples, see the following resources:

  • Article 237677 (https://go.microsoft.com/fwlink/?LinkID=87487) in the Microsoft Knowledge Base

  • Article 555636 (https://go.microsoft.com/fwlink/?LinkId=187670) in the Microsoft Knowledge Base

Formatting legend

Format Meaning


Information that the user must supply


Elements that the user must type exactly as shown

Ellipsis (...)

Parameter that can be repeated several times in a command line

Between brackets ([])

Optional items

Between braces ({}); choices separated by pipe (|). Example: {even|odd}

Set of choices from which the user must choose only one

Courier font

Code or program output

See Also


Command-line reference A-Z
Command shell overview