Solved

Can Active Directory user account SID be exported to file?

Posted on 2011-09-30
6
4,862 Views
Last Modified: 2012-05-12
Points of My Scenario
1. I am admin of a Windows Server 2003 domain
2. I have a cross-forest trust with an external forest & domain
3. Users must be migrated to the external domain
4. I have been tasked to provide the SID history of my domain users (I'm not sure this is a proper request).
QUESTION: Can the SID history of accounts be exported to file?
0
Comment
Question by:waltforbes
6 Comments
 
LVL 57

Expert Comment

by:Mike Kline
ID: 36894735
You can use a tool called adfind

http://www.joeware.net/freetools/tools/adfind/index.htm

adfind -default -f "&(objectcategory=person)(objectclass=user)(sidhistory=*)" samaccountname sidhistory

That will only list users that have sidhistory populated.  

Thanks

Mike
0
 
LVL 95

Expert Comment

by:Lee W, MVP
ID: 36894946
I think what you want to do is use the Active Directory Migration Tool - ADMT - check it out.
0
 
LVL 39

Expert Comment

by:Krzysztof Pytko
ID: 36896140
That's strange. Why they want to have SIDs of all of your users? Maybe they want to somehow enumerate them in the new domain (I don't know). As leew mentioned, to migrate users from one domain into another you have to use ADMT which creates SID History for an object automatically.

SID is unique for each object, so when you migrate user into another domain, its SID is assigned from that domain SID's database and it's also unique within that domain. The only difference for existing user in the domain is that SID History is set up with SID from previous domain to preserve access to network resources without changing ACLs on files/folders by administrator.

Anyway, if you wish to export all user SIDs to text file, you can use Microsoft DS Tools for that, Quest PowerSHell module for AD or mentioned ADFIND by Mike.

To export SIDs using DS Tools, run this syntax on any DC or workstation with Administrative Tools installed

dsquery * -filter "&(&(objectClass=User)(objectCategory=Person))" -limit 0 -attr sAMAccountName givenName sn objectSID >>c:\SIDs.txt

for Quest PowerShell use

Get-QADUser -name * -sizelimit 0 | Select sAMAccountName,givenName,sn,objectSID | Export-CSV c:\SIDs.csv

or modify a little bit Mike's ADFIND example (if you wish to use ADFIND)

Regards,
Krzysztof
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
LVL 39

Accepted Solution

by:
Krzysztof Pytko earned 500 total points
ID: 36896177
Actually for Quest PS syntax it's better to use SID attribute, instead of objectSID.
So, proper syntax is

Get-QADUser -name * -sizelimit 0 | Select sAMAccountName,givenName,sn,SID | Export-CSV c:\SIDs.csv

Krzysztof
0
 

Author Closing Comment

by:waltforbes
ID: 36903923
To iSiek: this is EXACTLY what I needed. I am sooo grateful! Many, many thanks!
0
 
LVL 39

Expert Comment

by:Krzysztof Pytko
ID: 36904264
You're welcome :)
I'm glad I could help

Krzysztof
0

Featured Post

Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
This script can help you clean up your user profile database by comparing profiles to Active Directory users in a particular OU, and removing the profiles that don't match.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

947 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

23 Experts available now in Live!

Get 1:1 Help Now