LDIF is the raw change format for LDAP writes. We use it when we want direct control over attributes such as description, member, userAccountControl, unicodePwd, servicePrincipalName, and msDS-KeyCredentialLink.
export DC=10.10.10.200
export DOMAIN=ootw.local
export USER='student'
export PASS='student'
Apply a change:
LDAPTLS_REQCERT=never ldapmodify -H ldaps://$DC:636 -D "$DOMAIN\\$USER" -w "$PASS" -f change.ldif
Replace description:
dn: CN=svc_web,OU=Service Accounts,OU=OOTW Lab,DC=ootw,DC=local
changetype: modify
replace: description
description: modified-by-student
Add a group member:
dn: CN=ACL Operators,OU=Groups,OU=OOTW Lab,DC=ootw,DC=local
changetype: modify
add: member
member: CN=student,CN=Users,DC=ootw,DC=local
Remove a group member:
dn: CN=ACL Operators,OU=Groups,OU=OOTW Lab,DC=ootw,DC=local
changetype: modify
delete: member
member: CN=student,CN=Users,DC=ootw,DC=local
Add a fake SPN:
dn: CN=svc_web,OU=Service Accounts,OU=OOTW Lab,DC=ootw,DC=local
changetype: modify
add: servicePrincipalName
servicePrincipalName: ootw/fake
Remove a fake SPN:
dn: CN=svc_web,OU=Service Accounts,OU=OOTW Lab,DC=ootw,DC=local
changetype: modify
delete: servicePrincipalName
servicePrincipalName: ootw/fake
Replace userAccountControl:
dn: CN=svc_web,OU=Service Accounts,OU=OOTW Lab,DC=ootw,DC=local
changetype: modify
replace: userAccountControl
userAccountControl: 4260352
Delete an exact Shadow Credentials blob:
dn: CN=svc_web,OU=Service Accounts,OU=OOTW Lab,DC=ootw,DC=local
changetype: modify
delete: msDS-KeyCredentialLink
msDS-KeyCredentialLink: <EXACT_BLOB_FROM_BACKUP>
Delete an object:
dn: CN=temporary,CN=Users,DC=ootw,DC=local
changetype: delete