Add cross-platform install docs to README
This commit is contained in:
mikisoq
@@ -1,84 +1,90 @@
|
|||||||
# AD Bulk Tool prototype
|
# AD Bulk Tool
|
||||||
|
|
||||||
A small Avalonia + C# prototype for bulk Active Directory edits from a CSV.
|
Cross-platform Avalonia UI app for bulk Active Directory operations from a CSV file.
|
||||||
|
|
||||||
## What it currently does
|
## Prerequisites
|
||||||
|
|
||||||
- Load a CSV file.
|
- [.NET 8 SDK](https://dotnet.microsoft.com/download/dotnet/8.0)
|
||||||
- Show all CSV headers in a human-readable dropdown, including duplicate column names as `1: Name`, `2: Name`, etc.
|
|
||||||
- Select one of these actions:
|
|
||||||
- Disable user
|
|
||||||
- Enable user
|
|
||||||
- Add to group
|
|
||||||
- Remove from group
|
|
||||||
- Set random password
|
|
||||||
- Set password change at next login
|
|
||||||
- Set random password + change at next login
|
|
||||||
- Preview changes locally.
|
|
||||||
- Run a real AD dry run that binds to LDAP/LDAPS and validates users.
|
|
||||||
- Execute changes against AD.
|
|
||||||
- Test DNS, TCP 389, TCP 636, LDAP bind on 389, and LDAPS bind on 636 before running a job.
|
|
||||||
- Use two presets:
|
|
||||||
- `Use LDAP 389 (normal edits)`
|
|
||||||
- `Use LDAPS 636 (password edits)`
|
|
||||||
|
|
||||||
## Important safety notes
|
### Windows
|
||||||
|
|
||||||
- Test with a dedicated test OU and test accounts first.
|
```powershell
|
||||||
- Leave `Dry run` enabled until you are sure the mapping is correct.
|
winget install Microsoft.DotNet.SDK.8
|
||||||
- Normal edits such as enable, disable, add to group, and remove from group can use LDAP 389.
|
```
|
||||||
- Password reset actions require LDAPS 636 and are blocked if LDAP 389 is selected.
|
|
||||||
- `Set password change at next login` sets `pwdLastSet=0`; it does not generate a new password.
|
|
||||||
- Do not use `Ignore cert errors` in production. Install your internal root CA on the Linux machine instead.
|
|
||||||
- The prototype shows generated passwords in the result list. Treat the screen as sensitive.
|
|
||||||
|
|
||||||
## Run
|
### Linux (Arch / CachyOS)
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
|
sudo pacman -S dotnet-sdk-8.0
|
||||||
|
```
|
||||||
|
|
||||||
|
### Linux (Ubuntu / Debian)
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Register Microsoft repository, then:
|
||||||
|
sudo apt install dotnet-sdk-8.0
|
||||||
|
```
|
||||||
|
|
||||||
|
### macOS
|
||||||
|
|
||||||
|
```bash
|
||||||
|
brew install dotnet-sdk-8.0
|
||||||
|
```
|
||||||
|
|
||||||
|
## Build & Run
|
||||||
|
|
||||||
|
```bash
|
||||||
|
git clone https://gitea.mikisoq.cc/mikisoq/ADBulk.git
|
||||||
|
cd ADBulk
|
||||||
dotnet restore
|
dotnet restore
|
||||||
|
dotnet build
|
||||||
dotnet run
|
dotnet run
|
||||||
```
|
```
|
||||||
|
|
||||||
## Typical values
|
On Windows, you can also open the folder in Visual Studio and run from there.
|
||||||
|
|
||||||
For normal edits:
|
## Features
|
||||||
|
|
||||||
```text
|
- Load a CSV with any column structure
|
||||||
LDAP host: [DomainController hostname]
|
- Auto-discover the AD domain and domain controller via DNS (click **Discover** or runs on startup)
|
||||||
Port: 389
|
- Supports LDAP 389 (normal edits) and LDAPS 636 (password resets)
|
||||||
Use LDAPS: unchecked
|
- Built-in port/connectivity health check
|
||||||
Search base DN: DC=Your,DC=domain
|
- Dry-run mode to validate before making changes
|
||||||
Bind username: Your\your-admin-user or your-admin-user@YourDomain
|
- Actions: enable, disable, add/remove from group, set/force password change
|
||||||
```
|
|
||||||
|
|
||||||
For password reset actions:
|
## Quick start
|
||||||
|
|
||||||
```text
|
1. Launch the app
|
||||||
LDAP host: [DomainController hostname]
|
2. Click **Discover** (or let it auto-detect on startup)
|
||||||
Port: 636
|
3. Enter your AD bind username and password
|
||||||
Use LDAPS: checked
|
4. Click **Test ports + LDAP/LDAPS** to verify connectivity
|
||||||
Search base DN: DC=Your,DC=domain
|
5. Load a CSV
|
||||||
Bind username: Your\your-admin-user or your-admin-user@YourDomain
|
6. Select the username column and an action
|
||||||
```
|
7. Run **Preview** then **Dry run** before executing
|
||||||
|
|
||||||
## Recommended test order
|
## Safety
|
||||||
|
|
||||||
1. Enter host, search base, bind username, and bind password.
|
- Test with a dedicated test OU and test accounts first
|
||||||
2. Click `Test ports + LDAP/LDAPS`.
|
- Keep **Dry run** enabled until you are sure the mapping is correct
|
||||||
3. Confirm whether LDAP 389 works.
|
- Password reset actions require LDAPS and are blocked on plain LDAP
|
||||||
4. Confirm whether LDAPS 636 works.
|
- Do not use **Ignore cert errors** in production
|
||||||
5. Load a tiny CSV with test users.
|
|
||||||
6. Run `Preview`.
|
|
||||||
7. Run with `Dry run` checked.
|
|
||||||
8. Only then run without `Dry run`.
|
|
||||||
|
|
||||||
## Linux LDAPS trust
|
## LDAPS certificate trust
|
||||||
|
|
||||||
For proper LDAPS, your Linux machine must trust the CA that issued the domain controller LDAP certificate.
|
### Linux
|
||||||
On Arch/CachyOS, this is commonly done by placing your root CA certificate under `/etc/ca-certificates/trust-source/anchors/` and running:
|
|
||||||
|
Place your root CA certificate and run:
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
|
# Arch / CachyOS
|
||||||
|
sudo cp your-root-ca.crt /etc/ca-certificates/trust-source/anchors/
|
||||||
sudo trust extract-compat
|
sudo trust extract-compat
|
||||||
|
|
||||||
|
# Ubuntu / Debian
|
||||||
|
sudo cp your-root-ca.crt /usr/local/share/ca-certificates/
|
||||||
|
sudo update-ca-certificates
|
||||||
```
|
```
|
||||||
|
|
||||||
Exact CA trust commands depend on your Linux distribution.
|
### Windows
|
||||||
|
|
||||||
|
If the domain controller certificate is already trusted by the domain, nothing extra is needed. Otherwise, import the root CA into the **Trusted Root Certification Authorities** store.
|
||||||
|
|||||||
Reference in New Issue
Block a user