How to Import Users and Groups from Active Directory

Who is this article for?

 Q-Pulse Administrators managing user access.

 Administration module access and an understanding of AD is needed.

Q-Pulse users can be created manually but if you have a lot of users to manage then you may want to consider importing them from active directory.

This article outlines how to perform the import and provides additional guidance and links to LDAP resources. It does not teach you how to use LDAP as this is not part of Q-Pulse but it does provide links to third party resources to help you.

To make the process easier to follow the article has been split into the following sections:

1. Preparing to Import from Active Directory
2. How to Import Users from Active Directory
3. Additional Notes
4. Further Reading

Important Note: This import is intended as a one-time import. This is not a regular sync with active directory.

1. Preparing to Import from Active Directory

Users and groups can be imported into Q-Pulse from Microsoft's Active Directory (AD) service. In addition to improving security, AD was introduced to reduce the management overhead of Windows networks. Importing allows for a faster and more convenient way of establishing your Q-Pulse configuration and saves you the trouble of manually creating users and groups.

Once imported, AD users become Q-Pulse users and AD security groups become Q-Pulse static security groups.

Users and groups are imported using standardised Lightweight Directory Access Protocol (LDAP) URLs and search filters. You may need assistance from your IT department to import from AD.

Before performing an import it is strongly recommended you review the considerations below: 

2. How to Import Users from Active Directory

2.1. The Import Feature

1. Open the Administration module.
2. Navigate to Security and then to People.
3. Click Import, and then From Active Directory.

4. Enter the LDAP URL into the Active Directory Node Path.

Notes:

• Global Catalog (GC) node paths can also be entered into this field to automatically generate LDAP URLs when clicking the ellipsis […] button to the right of the field.
• If you click the [OK] button without entering anything into this field, the import utility will attempt to retrieve a list of users and groups from the local Windows domain. The image below shows the import utility configured to import users and groups from the GC of the dwm.local domain.
• When entering LDAP URLs, ensure LDAP is entered using capital letters to prevent errors.

2.2. Example LDAP URLs for Domain dwm.local

All users and security groups on the dc01.dwm.local server using the default LDAP port (389).

LDAP://dc01.dwm.local/DC=dwm,DC=local

All users and security groups in the Accounts OU located within the Departments OU at the top-level of AD on the dc01.dwm.local server using a non-default LDAP port (765).

LDAP://dc01.dwm.local:765/OU=Accounts,OU=Departments,DC=dwm,DC=local

Import just the user with the Common Name (CN) Mike Jones found within the IT OU within the Departments OU at the top-level of AD on the dc01.dwm.local server using the default port (389).

LDAP://dc01.dwm.local/CN=Mike Jones,OU=IT,OU=Departments,DC=dwm,DC=local

2.3. Advanced Import Options

Additional import options can be accessed using the Advanced>> button. These options are highlighted in the image below and allow for additional filtering and querying of users and groups using LDAP search filters.
 

Before using the advanced options shown above, the Active Directory Node Path field should be populated. If it isn’t, the import utility will attempt to apply the filters against the local Windows domain.

Need more help with LDAP queries? Ideagen cannot support you in writing queries but additional information about search filters can be found in the LDAP Query Basics article published by Microsoft.

3. Additional Notes 

• Under certain circumstances, not all users may be available for import even when they have first and last names in AD. In this case, it may be easier to import the users from Microsoft Exchange or to manually create the users. For example, an enabled user already in Q-Pulse may have the same full name as a user to be imported. This AD user won’t show on the import results screen.
• There is no technical difference between users created manually and users that have been imported. For example, you can manually create users and add a CN and email address to their account.
• The Specify Default Password option can be used to set a default Q-Pulse password for all imported users. This Q-Pulse password will only be used when logging into Q-Pulse using Q-Pulse authentication and when signing back in to Q-Pulse after a session timeout (if the Session Timeout add-on has been purchased and enabled).
• Be careful to import only the users and groups you wish to import. Otherwise, you could import many users and groups not required resulting in a negative impact on your Q-Pulse configuration. Ensure you have full, up-to-date and clean database backups before importing. This allows your Q-Pulse database to be restored if an error occurs or if a mistake is made during the import.
• Q-Pulse groups can be associated with AD groups using Active Directory Group Integration and importing users allows for an easier transition to Q-Pulse’s Windows authentication methods as accounts will automatically be configured with a CN.
• Q-Pulse users imported from AD are not synchronised with AD. For example, if a user’s name or email address is changed in AD, this information won’t change automatically in Q-Pulse. A manual update is required.
• Users imported are imported as Employee users of Q-Pulse.

4. Further Reading

• How to Integrate Q-Pulse Groups with Active Directory Groups