Find a windoews account name from SID number

Hi,
I used the get -mailboxstatistics command on exchange to get the statistics of a mailbox whose Ricipient Type Detail came up as 'Linked Mailbox'. In the information, under LinkedMasterAccount all I have is the SID (S-1-5-21-796845957-1682526488-839522115-5464). I need to know how to find out the account name rom the SID as this mailbox is receiving e-mails sent to a special distribution group for which it is not a member.

Thank you
Gospodin RasputinIT ManagerAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Mike ThomasConsultantCommented:
0
MegaNuk3Commented:
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Gospodin RasputinIT  ManagerAuthor Commented:
Hi Mojo,
Your suggestion would be applicable if I knew where the MAster account had logged into. In my case, the account might not even be a user account, therefore I cannot guess which PC it could have logged into.
I was thinking maybe ther is somewhere on the DC AD where this information would be kept.
Thank you.
0
Challenges in Government Cyber Security

Has cyber security been a challenge in your government organization? Are you looking to improve your government's network security? Learn more about how to improve your government organization's security by viewing our on-demand webinar!

Gospodin RasputinIT  ManagerAuthor Commented:
Hi MegaNuk3.
I am getting the following error whe I use the utility

ERROR: LookupAccountSid: (1332) No mapping between account names and security ID
s was done.

The command did NOT complete successfully.

Thanks
0
MegaNuk3Commented:
Hmmm, have you tried it on a SID that you know has an account? i.e. like your own? to make sure the tool works?

Maybe the account associated with the SID you are looking for has been deleted?
0
BikkelbinkCommented:
When the user is situated in another domain/fores, you need access to that forest/domain to query AD.
If the user was from the same domain, then the user account does not exist anymore.
To query another domain to find the user with your SID is:

get-user -resultsize unlimited | where {$_.sid -eq "S-1-5-21-796845957-1682526488-839522115-5464"}

0
MegaNuk3Commented:
Also when you ran SIdToName did you run it as follows:
sidtoname  <SID> <DCName>

e.g. sidtoname S-1-5-21-796845957-1682526488-839522115-5464 dc01
0
Gospodin RasputinIT  ManagerAuthor Commented:
Yes, I ran it exactly as such.

Most likely that the account has been deleted. Will try the get-user resultsize unlimited and see what I get.
Thank you
GRasputin
0
MegaNuk3Commented:
Or you can create a custom AD query in ADUC with
(objectSid=S-1-5-21-796845957-1682526488-839522115-5464)

or
DSQUERY * -filter (objectSid=S-1-5-21-796845957-1682526488-839522115-5464)

If those don't return results then account has been deleted...
0
milikadCommented:
Hi,
Look at below link and user adrestore.net tool to recover the delete item
http://www.petri.co.il/recovering-deleted-items-active-directory.htm 
Milind
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.