Solved

Does Active Directory users have unique IDs?

Posted on 2009-05-19
7
540 Views
Last Modified: 2013-11-05
hi, does Active Directory users have unique IDs? if so what the name of this property?
0
Comment
Question by:Abdu_Allah
7 Comments
 
LVL 1

Assisted Solution

by:systemagic
systemagic earned 25 total points
ID: 24426244
All Active directory objects have unique security identifiers which are referred to as SID numbers.
0
 
LVL 3

Assisted Solution

by:Cameron_S
Cameron_S earned 25 total points
ID: 24426309
Systemagic is correct. Also, sAMAccountName is the unique name (login name, essentially) specifically to users, if you needed a logical reference outside a numerical one.
0
 
LVL 57

Assisted Solution

by:Mike Kline
Mike Kline earned 50 total points
ID: 24426346
Yes a SID is the name, every user has one, there are also well known SIDs. More on that here
http://support.microsoft.com/kb/243330
Well-known security identifiers in Windows operating systems
Want to quickly find the SID of a user object.  Use adfind by MVP Joe Richards
http://www.joeware.net/freetools/tools/adfind/index.htm
use one of the shortcuts Joe has provided for a user
adfind -sc u:USERNAME objectsid
Thanks
Mike

adfind-SID.jpg
0
6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

 
LVL 70

Assisted Solution

by:Chris Dent
Chris Dent earned 400 total points
ID: 24429900

These are the unique properties:

objectGUID - Unique within a Forest. Cannot be changed.

sAMAccountName - Unique within a Domain. Can be changed.

sID (Security Identifier) - Unique within a Forest. Cannot be changed, may have an additional entry in sIDHistory.

userPrincipalName - Unique within a Forest. Can be changed.

There are a few others, but those are the most reliable. Depending on your goal the objectGUID may be the best for a couple of reasons:

1. It never changes unless the account object is destroyed (rename or move the account and it'll still be there)
2. You can bind to an account using the GUID

Chris
0
 
LVL 3

Author Comment

by:Abdu_Allah
ID: 24430788
And how do I retreive this sID using scripts?
Point raised to 500
0
 
LVL 3

Author Comment

by:Abdu_Allah
ID: 24430797
ASP or ASP.NET script please.
0
 
LVL 70

Accepted Solution

by:
Chris Dent earned 400 total points
ID: 24431147

For the SID in ASP .NET using DirectoryServices this example is good enough:

http://www.netomatix.com/getusersid.aspx

If you look at the code for "ConvertByteToStringSid" you'll see that it isn't a pleasant field to work with. The same can be said of objectGUID to an extent, but it has some converters...

VB .NET:

Dim adUser As New DirectoryEntry("LDAP://CN=Some users,OU=Somewhere,DC=domain,DC=com")
Dim objectGUID As Byte() = adUser.Properties("objectGuid").Value
Dim GUID As New System.Guid(objectGUID)
' GUID String is held in:
' GUID.ToString()

Chris
0

Featured Post

6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

Join & Write a Comment

Companies that have implemented Microsoft’s Active Directory need to ensure that the Active Directory is configured and operating properly. If there are issues found and not resolved, it eventually leads the components to fail or stop working and fi…
Do you have users whose passwords are expiring and they are constantly calling you?  Well I sure did and needed a way to put an end to this.  We have a lot of remote users which would not be notified that their passwords were expiring since they wer…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now