add all AD-User as User to add AD-User to Responsible

[Tutter-xp]

hi everyone, 

we had connected our active directory with netbox. and so we would import every User in the Active directory to netbox. the problem is this is only possible when the AD-User was first logged in netbox. how we can create all User or import all User in netbox? with the import function it isn´t possible then we don´t know the passwort from every Windowsaccount ;-). 
The Goal: we would have every AD-User in Netbox to match the User to responsible. so we would match the AD-User to the right asset.

It is possible? Installation is on premise and so we could insert in the database or bulid an python script. 

[sambai-dev]

Yes, and you do not need to write to the database directly. NetBox has two supported ways to pre-provision accounts, both scriptable from Active Directory.

1. Built-in CSV import. NetBox ships a user bulk importer (UserImportForm, wired up by UserBulkImportView) that accepts username, first_name, last_name, email, password, is_active and is_superuser columns, and calls set_password() on save so the password lands hashed. Export your AD users (for example with PowerShell Get-ADUser) into that column shape and run it through Admin > Authentication > Users > Import. Fields verified in netbox/users/forms/bulk_import.py.

2. REST API. POST /api/users/users/ creates a user with the same fields; the password attribute is write-only there as well. A short script that enumerates AD and POSTs each entry is the better fit if you want provisioning to repeat as users come and go.

On the passwords question: pre-setting them does not conflict with AD sign-in. Confirmed from source: with LDAP enabled, AUTHENTICATION_BACKENDS contains your remote backend plus ObjectPermissionBackend only, so Django's password-checking ModelBackend is never consulted and AD logins are validated by binding to the directory (settings.py). The behavior you noticed comes from django-auth-ldap creating local accounts lazily: its _get_or_create_user() materializes the row during the first successful bind, assigns an unusable password, and populates names/email from AUTH_LDAP_USER_ATTR_MAP. Pre-creating the rows just removes the requirement that every person logs in once before you can reference them.

One alternative worth considering given the end goal: if these entries only need to be selectable as responsible parties on assets, Contact records may be enough. Contacts are standalone individuals with roles assigned to most object types and carry no login capability, so you could model responsibility without provisioning any users: https://docs.netbox.dev/en/stable/features/contacts/

Verified against the current main branch (4.6.x series) by reading source; I have not executed this against a live AD domain.