Question

I’m adding some attributes from live to staging for testing purposes, I’m using ldifde:

D:\Shared>ldifde -i -v -f attr3.ldf -j .
Connecting to "myDomain.com"
Logging in as current user using SSPI
Importing directory from file "attr3.ldf"
Loading entries
1: CN=myAttribute,CN=Schema,CN=Configuration,DC=myDomain,DC=com
Entry modified successfully.


1 entry modified successfully.

The command has completed successfully

D:\Shared>

But when I try to update it using vbs, I got:

C:\Users\update.vbs(8, 1) Active Directory: The requested operation did not 
satisfy one or more constraints associated with the class of the object.

Please notice that other attributes, the original ones, are able to be updated, this issue is only for the ones I’m importing.

So, I wonder if I’m missing some step like link or detach the new attribute after imported.

This is attr3.ldf

#attr3.ldf
#adding my new attribute
dn: CN=myAttribute,CN=Schema,CN=Configuration,DC=myDomain,DC=com
changetype: add
objectClass: top
objectClass: attributeSchema
cn: my-Attribute
distinguishedName: CN=my-Attribute,CN=Schema,CN=Configuration,DC=myDomain,DC=com
instanceType: 4
whenCreated: 20100401175340.0Z
whenChanged: 20100401175341.0Z
uSNCreated: 24154
attributeID: 2.16.840.1.113805.111
attributeSyntax: 2.5.5.12
isSingleValued: TRUE
rangeLower: 0
rangeUpper: 1
uSNChanged: 24163
showInAdvancedViewOnly: TRUE
adminDisplayName: my-Attribute
adminDescription: my-Attribute
oMSyntax: 64
searchFlags: 0
lDAPDisplayName: myAttribute
name: my-Attribute
schemaIDGUID:: tonVW6suWUu1Gev/D1pI9Q==
isMemberOfPartialAttributeSet: TRUE
objectCategory: CN=Attribute-Schema,CN=Schema,CN=Configuration,DC=myDomain,DC=com

#The following attributes were removed because I was getting:
#Add error on entry starting on line 1: Unwilling To Perform
#The server side error is: 0x20e7 The modification was not permitted for security
#reasons.
#The extended server error is:
#000020E7: SvcErr: DSID-03152D2C, problem 5003 (WILL_NOT_PERFORM), data 0

#objectGUID:: eTKYtnXbCE2fPMgc8UIe0w==
#attributeSecurityGUID:: VAGN5Pi80RGHAgDAT7lgUA==

And this is the vbs code,

'update.vbs
Set objUser = GetObject("LDAP://CN=John Lennon,CN=Users,DC=myDomain,DC=com") 
objUser.myAttribute="someValue"  'Also tried with integers but not luck
objUser.SetInfo

Thanks,
m0dest0.

---

Thank you JPBlanc, you are right, I was missing to add the attr to the class and then refresh the schema,

1. Register the dll, regsvr32 schmmgmt.dll
2. Open Run and type mmc.exe
3. Add Active directory schema snap-in
4. Right click on the class, properties and hit the Add button and so on.

5. Finally, refresh the schema:

   C:\Users>admod -sc refreshschema

   AdMod V01.17.00cpp Joe Richards ([e-mail]) March 2011

   Modifying ROOTDSE…
   DN Count: 1
   Using server: myServer.myDomain.com:389
   Directory: Windows Server 2008 R2

   Modifying specified objects…
   DN: ROOTDSE…

   The command completed successfully

Regards,

Answer 1

Adding an attribute to the Schema is not enought, you must also add the attribute to the user class (in the schma) if you want to use it in a user object. You must modify your LDIF file:

# Define your attribute

# Reload the schema
dn:
changetype: modify
add: schemaUpdateNow
schemaUpdateNow: 1
-
# modify user class

Have a look to your Schema using Microsoft MMC (registering schmmgmt.dll)

If you still have trouble, I can help again tomorow morning.