Add cross-platform install docs to README
This commit is contained in:
mikisoq
@@ -1,84 +1,90 @@
|
||||
# AD Bulk Tool prototype
|
||||
# AD Bulk Tool
|
||||
|
||||
A small Avalonia + C# prototype for bulk Active Directory edits from a CSV.
|
||||
Cross-platform Avalonia UI app for bulk Active Directory operations from a CSV file.
|
||||
|
||||
## What it currently does
|
||||
## Prerequisites
|
||||
|
||||
- Load a CSV file.
|
||||
- Show all CSV headers in a human-readable dropdown, including duplicate column names as `1: Name`, `2: Name`, etc.
|
||||
- Select one of these actions:
|
||||
- Disable user
|
||||
- Enable user
|
||||
- Add to group
|
||||
- Remove from group
|
||||
- Set random password
|
||||
- Set password change at next login
|
||||
- Set random password + change at next login
|
||||
- Preview changes locally.
|
||||
- Run a real AD dry run that binds to LDAP/LDAPS and validates users.
|
||||
- Execute changes against AD.
|
||||
- Test DNS, TCP 389, TCP 636, LDAP bind on 389, and LDAPS bind on 636 before running a job.
|
||||
- Use two presets:
|
||||
- `Use LDAP 389 (normal edits)`
|
||||
- `Use LDAPS 636 (password edits)`
|
||||
- [.NET 8 SDK](https://dotnet.microsoft.com/download/dotnet/8.0)
|
||||
|
||||
## Important safety notes
|
||||
### Windows
|
||||
|
||||
- Test with a dedicated test OU and test accounts first.
|
||||
- Leave `Dry run` enabled until you are sure the mapping is correct.
|
||||
- Normal edits such as enable, disable, add to group, and remove from group can use LDAP 389.
|
||||
- Password reset actions require LDAPS 636 and are blocked if LDAP 389 is selected.
|
||||
- `Set password change at next login` sets `pwdLastSet=0`; it does not generate a new password.
|
||||
- Do not use `Ignore cert errors` in production. Install your internal root CA on the Linux machine instead.
|
||||
- The prototype shows generated passwords in the result list. Treat the screen as sensitive.
|
||||
```powershell
|
||||
winget install Microsoft.DotNet.SDK.8
|
||||
```
|
||||
|
||||
## Run
|
||||
### Linux (Arch / CachyOS)
|
||||
|
||||
```bash
|
||||
sudo pacman -S dotnet-sdk-8.0
|
||||
```
|
||||
|
||||
### Linux (Ubuntu / Debian)
|
||||
|
||||
```bash
|
||||
# Register Microsoft repository, then:
|
||||
sudo apt install dotnet-sdk-8.0
|
||||
```
|
||||
|
||||
### macOS
|
||||
|
||||
```bash
|
||||
brew install dotnet-sdk-8.0
|
||||
```
|
||||
|
||||
## Build & Run
|
||||
|
||||
```bash
|
||||
git clone https://gitea.mikisoq.cc/mikisoq/ADBulk.git
|
||||
cd ADBulk
|
||||
dotnet restore
|
||||
dotnet build
|
||||
dotnet run
|
||||
```
|
||||
|
||||
## Typical values
|
||||
On Windows, you can also open the folder in Visual Studio and run from there.
|
||||
|
||||
For normal edits:
|
||||
## Features
|
||||
|
||||
```text
|
||||
LDAP host: [DomainController hostname]
|
||||
Port: 389
|
||||
Use LDAPS: unchecked
|
||||
Search base DN: DC=Your,DC=domain
|
||||
Bind username: Your\your-admin-user or your-admin-user@YourDomain
|
||||
```
|
||||
- Load a CSV with any column structure
|
||||
- Auto-discover the AD domain and domain controller via DNS (click **Discover** or runs on startup)
|
||||
- Supports LDAP 389 (normal edits) and LDAPS 636 (password resets)
|
||||
- Built-in port/connectivity health check
|
||||
- Dry-run mode to validate before making changes
|
||||
- Actions: enable, disable, add/remove from group, set/force password change
|
||||
|
||||
For password reset actions:
|
||||
## Quick start
|
||||
|
||||
```text
|
||||
LDAP host: [DomainController hostname]
|
||||
Port: 636
|
||||
Use LDAPS: checked
|
||||
Search base DN: DC=Your,DC=domain
|
||||
Bind username: Your\your-admin-user or your-admin-user@YourDomain
|
||||
```
|
||||
1. Launch the app
|
||||
2. Click **Discover** (or let it auto-detect on startup)
|
||||
3. Enter your AD bind username and password
|
||||
4. Click **Test ports + LDAP/LDAPS** to verify connectivity
|
||||
5. Load a CSV
|
||||
6. Select the username column and an action
|
||||
7. Run **Preview** then **Dry run** before executing
|
||||
|
||||
## Recommended test order
|
||||
## Safety
|
||||
|
||||
1. Enter host, search base, bind username, and bind password.
|
||||
2. Click `Test ports + LDAP/LDAPS`.
|
||||
3. Confirm whether LDAP 389 works.
|
||||
4. Confirm whether LDAPS 636 works.
|
||||
5. Load a tiny CSV with test users.
|
||||
6. Run `Preview`.
|
||||
7. Run with `Dry run` checked.
|
||||
8. Only then run without `Dry run`.
|
||||
- Test with a dedicated test OU and test accounts first
|
||||
- Keep **Dry run** enabled until you are sure the mapping is correct
|
||||
- Password reset actions require LDAPS and are blocked on plain LDAP
|
||||
- Do not use **Ignore cert errors** in production
|
||||
|
||||
## Linux LDAPS trust
|
||||
## LDAPS certificate trust
|
||||
|
||||
For proper LDAPS, your Linux machine must trust the CA that issued the domain controller LDAP certificate.
|
||||
On Arch/CachyOS, this is commonly done by placing your root CA certificate under `/etc/ca-certificates/trust-source/anchors/` and running:
|
||||
### Linux
|
||||
|
||||
Place your root CA certificate and run:
|
||||
|
||||
```bash
|
||||
# Arch / CachyOS
|
||||
sudo cp your-root-ca.crt /etc/ca-certificates/trust-source/anchors/
|
||||
sudo trust extract-compat
|
||||
|
||||
# Ubuntu / Debian
|
||||
sudo cp your-root-ca.crt /usr/local/share/ca-certificates/
|
||||
sudo update-ca-certificates
|
||||
```
|
||||
|
||||
Exact CA trust commands depend on your Linux distribution.
|
||||
### Windows
|
||||
|
||||
If the domain controller certificate is already trusted by the domain, nothing extra is needed. Otherwise, import the root CA into the **Trusted Root Certification Authorities** store.
|
||||
|
||||
Reference in New Issue
Block a user