Solved

Does Active Directory users have unique IDs?

Posted on 2009-05-19
7
547 Views
Last Modified: 2013-11-05
hi, does Active Directory users have unique IDs? if so what the name of this property?
0
Comment
Question by:Abdu_Allah
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
7 Comments
 
LVL 1

Assisted Solution

by:systemagic
systemagic earned 25 total points
ID: 24426244
All Active directory objects have unique security identifiers which are referred to as SID numbers.
0
 
LVL 3

Assisted Solution

by:Cameron_S
Cameron_S earned 25 total points
ID: 24426309
Systemagic is correct. Also, sAMAccountName is the unique name (login name, essentially) specifically to users, if you needed a logical reference outside a numerical one.
0
 
LVL 57

Assisted Solution

by:Mike Kline
Mike Kline earned 50 total points
ID: 24426346
Yes a SID is the name, every user has one, there are also well known SIDs. More on that here
http://support.microsoft.com/kb/243330
Well-known security identifiers in Windows operating systems
Want to quickly find the SID of a user object.  Use adfind by MVP Joe Richards
http://www.joeware.net/freetools/tools/adfind/index.htm
use one of the shortcuts Joe has provided for a user
adfind -sc u:USERNAME objectsid
Thanks
Mike

adfind-SID.jpg
0
Are your AD admin tools letting you down?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

 
LVL 71

Assisted Solution

by:Chris Dent
Chris Dent earned 400 total points
ID: 24429900

These are the unique properties:

objectGUID - Unique within a Forest. Cannot be changed.

sAMAccountName - Unique within a Domain. Can be changed.

sID (Security Identifier) - Unique within a Forest. Cannot be changed, may have an additional entry in sIDHistory.

userPrincipalName - Unique within a Forest. Can be changed.

There are a few others, but those are the most reliable. Depending on your goal the objectGUID may be the best for a couple of reasons:

1. It never changes unless the account object is destroyed (rename or move the account and it'll still be there)
2. You can bind to an account using the GUID

Chris
0
 
LVL 3

Author Comment

by:Abdu_Allah
ID: 24430788
And how do I retreive this sID using scripts?
Point raised to 500
0
 
LVL 3

Author Comment

by:Abdu_Allah
ID: 24430797
ASP or ASP.NET script please.
0
 
LVL 71

Accepted Solution

by:
Chris Dent earned 400 total points
ID: 24431147

For the SID in ASP .NET using DirectoryServices this example is good enough:

http://www.netomatix.com/getusersid.aspx

If you look at the code for "ConvertByteToStringSid" you'll see that it isn't a pleasant field to work with. The same can be said of objectGUID to an extent, but it has some converters...

VB .NET:

Dim adUser As New DirectoryEntry("LDAP://CN=Some users,OU=Somewhere,DC=domain,DC=com")
Dim objectGUID As Byte() = adUser.Properties("objectGuid").Value
Dim GUID As New System.Guid(objectGUID)
' GUID String is held in:
' GUID.ToString()

Chris
0

Featured Post

Enroll in May's Course of the Month

May’s Course of the Month is now available! Experts Exchange’s Premium Members and Team Accounts have access to a complimentary course each month as part of their membership—an extra way to increase training and boost professional development.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article shows how to deploy dynamic backgrounds to computers depending on the aspect ratio of display
A project that enables an administrator to perform actions within a user session context not just at the time of login but any time later on day(s) or week(s) later.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

737 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question