Moving jpegPhoto photos to the thumbnailPhoto attribute

There are a lot of clever people out there.  Unfortunately, I'm not amoungst them.  But, Joe Richards and Brian Desmond are!  Thanks to Joe for developing some great tools and Brian for showing me how to use some of them to do something tricky.

Anyway, on past the credit.  There are quite a few organizations out there that used the jpegPhoto attribute to store photos of users for use with 3rd party applications including my Directory Update and Directory Manager applications.  Microsoft is now using thumbnailPhoto as their photo-attribute-of-choice for Exchange 2010 and Outlook 2010.  That leaves a lot of us with our photos in jpegPhoto.

Using the ADFind and ADMod applications from Joe Richards, though, you can copy the jpegPhoto data in to the thumbnailPhoto attribute.  First, download and unzip these two applications. 

Here is an example of how to move user LukeHusky's photo:
adfind -f "(&(objectCategory=person)(objectClass=user)(samAccountName=LukeHusky)(jpegPhoto=*))" jpegPhoto -adcsv | admod BIN##thumbnailPhoto::{{jpegPhoto}}

If this works for one user, you can actually run this against ALL users that have data in the jpegPhoto attribute with this command.
adfind -f "(&(objectCategory=person)(objectClass=user)(jpegPhoto=*))" jpegPhoto -adcsv | admod BIN##thumbnailPhoto::{{jpegPhoto}} -unsafe

You can also run this so that it will stop after a specific number of errors, such as 5 in the case below:
adfind -f "(&(objectCategory=person)(objectClass=user)(jpegPhoto=*))" jpegPhoto -adcsv | admod BIN##thumbnailPhoto::{{jpegPhoto}} -exterr -upto 5

As always, test before doing AD-wide deployments!

GAL sync on a budget - Thanks Quest and Tony Murray

I was very dismayed to find that Microsoft has discontinued support for the old Identity Integration Feature Pack (IIFP) tool that was a subset of their Microsoft Identity Integration Server. This tool was "free" and allowed you to do a reasonably easy directory sync between 2 Active Directory forests (User -> Mail-enabled Contact.)   I say "reasonably easy" because compared to a full blown install of MIIS, it was easier but still not simple. 

The folks at Quest have once again recognized a hole in the market and have provided a free tool.  Active Directory MVP Tony Murray has written a couple of good articles on using this tool.   See:

GAL Sync with Quest Quick Connect Express for Active Directory 

Quest ActiveRoles Quick Connect Express: GAL Sync Step-by-step Guide 

Remember, both the tool and the articles are "free" so support is roughly going to be "you get what you paid for", but both Tony and Brian Desmond (Active Directory MVP) say it does what it is supposed to do.