How to Import/Export Active Directory Users with CSVDE?

CSVDE is a legacy Active Directory command-line tool that can import and export directory objects using CSV files. Although it is still included in Windows Server 2025, Microsoft administrators typically prefer PowerShell cmdlets or LDIFDE for new automation projects because CSVDE has several important limitations.

Contents

Syntax for the csvde utility

To get all the options and syntax for the csvde utility, just run this command in the command prompt:

csvde

CSV Directory Exchange

General Parameters
==================
-i Turn on Import Mode (The default is Export)
-f filename Input or Output filename
-s servername The server to bind to (Default to DC of computer’s domain)
-v Turn on Verbose Mode
-c FromDN ToDN Replace occurences of FromDN to ToDN
-j path Log File Location
-t port Port Number (default = 389)
-u Use Unicode format
-h Enable SASL layer signing and encryption
-? Help

Export Specific
===============

-d RootDN The root of the LDAP search (Default to Naming Context)
-r Filter LDAP search filter (Default to “(objectClass=*)”)
-p SearchScope Search Scope (Base/OneLevel/Subtree)
-l list List of attributes (comma separated) to look for in an

LDAP search

-o list List of attributes (comma separated) to omit from input.
-g Disable Paged Search.
-m Enable the SAM logic on export.
-n Do not export binary values

Import
======

-k The import will go on ignoring ‘Constraint Violation’ and
‘Object Already Exists’ errors

Credentials Establishment
=========================

Note that if no credentials is specified, CSVDE will bind as the currently
logged on user, using SSPI.

-a UserDN [Password | *] Simple authentication
-b UserName Domain [Password | *] SSPI bind method

Example: Simple import of current domain
csvde -i -f INPUT.CSV

Example: Simple export of current domain
csvde -f OUTPUT.CSV

Example: Export of specific domain with credentials
csvde -m -f OUTPUT.CSV

-b USERNAME DOMAINNAME *
-s SERVERNAME
-d “cn=users,DC=DOMAIN NAME,DC=Microsoft,DC=Com”
-r “(objectClass=user)”

No log files were written. In order to generate a log file, please
specify the log file path via the -j option.

Should you still use CSVDE?

CSVDE is still available in Windows Server 2025 and remains useful for simple LDAP imports and exports. However, for most modern AD admin tasks, we recommend using the Active Directory PowerShell module (because it supports creating, modifying, deleting, and managing objects with significantly greater flexibility).

For most bulk user provisioning tasks, you can now use the Active Directory PowerShell module together with the Import-Csv cmdlet instead of CSVDE.

When CSVDE is still useful?

You can still use CSVDE when you need to:

export large LDAP datasets;
migrate objects between directories;
quickly dump directory attributes for auditing;
work on servers where only built-in tools are available.

Using CSVDE

So, now let’s look at some examples of using the CSVDE tool:

Export directory objects

The following command exports all directory objects from the specified Active Directory OU:

csvde -f  C:\PS\all_users.csv -d "ou=Users,OU=Paris,dc=theitbros,dc=com" -u

Connecting to “(null)”
Logging in as current user using SSPI
Exporting directory to file C:\PS\all_users.csv
Searching for entries…
Writing out entries
Export Completed. Post-processing in progress…
343 entries exported

The command has completed successfully

Export only user accounts

To export only user accounts, use the following filter with the –r parameter. Using the –l parameter, you can specify which user attributes should be exported to the csv file:

csvde -f C:\PS\all_users.csv -d "ou=Users,OU=Paris,dc=theitbros,dc=com" -r "(&(objectCategory=person)(objectClass=user))" -l userPrincipalName,DN,objectClass,description,department,title,telephoneNumber

Export disabled user accounts

You can use the following LDAP filter to export only disabled user accounts:

csvde -f C:\PS\disabled_users.csv -r "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=2))"

Prepare a CSV File for Import

You can export this file to Excel and use it as a template for importing users into Active Directory. Note that CSVDE requires the first line of the file to be a comma-separated list of attributes. Also, be careful when editing CSV files in Excel, as it may automatically change data formatting/encoding.

Create users.csv file with the following values:

objectClass,sAMAccountName,DN
user,m.decker,"CN=Moritz Decker,OU=Users,OU=Munich,OU=DE,DC=theitbros,DC=com"
user,m.decker1,"CN=Moritz Decker1,OU=Users,OU=Munich,OU=DE,DC=theitbros,DC=com"

Bulk create users in AD

To bulk create users in AD, run the command:

Csvde -i -f C:\ps\new_users.csv -k

Connecting to “(null)”
Logging in as current user using SSPI
Importing directory from file “C:\ps\new_users.csv”
Loading entries…….
6 entries modified successfully.

CSVDE imported six user objects into Active Directory. Although the CSVDE output says “entries modified successfully”, this is the tool’s standard success message. In this example, CSVDE creates new user objects — it does not modify existing AD objects.

Keep in mind that you should use -k carefully because duplicate objects/constraint violations will be skipped, potentially hiding import problems.

Note that Imported users are created without passwords and remain disabled until a password is assigned and the account is enabled.

After importing users with CSVDE, you must assign a password before enabling the accounts. Simply running Enable-ADAccount is not sufficient because imported users are created without passwords and cannot sign in until a password is set.

Start the Active Directory Users and Computers snap-in (dsa.msc) and verify that there are new users in AD.

All user accounts are disabled. You can enable them manually or using the following PowerShell command:

# Replace with your organization's password policy
$Password = ConvertTo-SecureString "P@ssw0rd!" -AsPlainText -Force

Get-ADUser -Filter * -SearchBase "OU=Users,OU=Munich,OU=DE,DC=theitbros,DC=com" |
ForEach-Object {
    Set-ADAccountPassword -Identity $_ -NewPassword $Password
    Enable-ADAccount -Identity $_
}

Main cons of csvde

Feature	CSVDE	PowerShell AD Module
Create objects	Yes	Yes
Modify objects	No	Yes
Delete objects	No	Yes
Set passwords	No	Yes
Manage group membership	Limited	Yes
Bulk automation	Limited	Yes
Status	Legacy	Recommended

Cannot modify existing objects.
Cannot set passwords during import.
No support for incremental updates.
CSV format is less flexible than LDIFDE.
No transactional import/rollback.

What is CSVDE used for?

CSVDE (CSV Directory Exchange) is a legacy command-line utility that imports and exports Active Directory objects using CSV files. It’s commonly used to export directory data, create new objects in bulk, and migrate simple LDAP datasets.

Can CSVDE modify or delete existing Active Directory objects?

No. CSVDE can only create new objects during import and export existing objects. It cannot modify, rename, or delete existing AD objects. For those tasks, use the Active Directory PowerShell module or LDIFDE.

Can CSVDE set passwords for imported users?

No. CSVDE cannot assign passwords during import. Newly imported user accounts are created in a disabled state until you set a password (for example, with Set-ADAccountPassword) and then enable the account.

What does the -k option do during CSVDE import?

The -k switch tells CSVDE to continue importing even if it encounters errors such as duplicate objects or constraint violations. While useful for large imports, it can also hide problems, so review the import results carefully.

Is CSVDE still recommended for Active Directory administration?

CSVDE is still included with Windows Server 2025 and remains useful for simple LDAP exports and imports. However, Microsoft administrators generally prefer the Active Directory PowerShell module because it supports creating, modifying, deleting, and managing objects with much greater flexibility.

Active Directory