How to get (AD) LDAP person entry by SID?

Question

Given the SID of a user or a group, how can I find a LDAP object that belongs to it?
LDAP Server ist Active Directory (Windows Server 2008).

A LDAP query String would be useful.

This table should help you, i know it helped me alot. http://www.kouti.com/tables/userattributes.htm — Sirex, Aug 17 '11 at 09:18
Hi Sirex, thanx for your comment. In the table you sent I saw that the attribute objectSid mandatory ist. But I do not see it as attribute in my ldap database. Why? — mtm, Aug 17 '11 at 11:33
@mtm That's because the `objectSID` attribute is from the Active Directory schema, it is not defined in the LDAP Schema. — jscott, Aug 17 '11 at 12:00
@jscott, I access my ldap database with "Apache Directory Studio", and see the attribute "objectSID" only by groups, and not by users. What could be the reason of it? — mtm, Aug 17 '11 at 12:14

score 6 · Answer 1 · answered Aug 17 '11 at 10:45

6

Another way would be to forsake LDAP and use WMIC:

H:\>wmic useraccount where (sid = "S-1-5-21-1698188384-1693678267-1543859470-6637") get * /format:list    

AccountType=512
Caption=MYDOMAIN\quux
Description=some guy's account
Disabled=FALSE
Domain=MYDOMAIN
FullName=Some Guy
InstallDate=
LocalAccount=FALSE
Lockout=FALSE
Name=quux
PasswordChangeable=TRUE
PasswordExpires=FALSE
PasswordRequired=TRUE
SID=S-1-5-21-1698188384-1693678267-1543859470-6637
SIDType=1
Status=OK

Now you have several attributes that should be easy to search via LDAP, if you still need to.

answered Aug 17 '11 at 10:45

quux

5,358
1
23
36

Hi quux, thank you! I cannot use command line tools.need a LDAP query for . – mtm Aug 17 '11 at 11:44
I cannot use command line tools. I get the SID in a programm and should use the SID-value (in some LDAP query) in order to get DirectoryEntry Object. – mtm Aug 17 '11 at 11:47

score 4 · Accepted Answer · edited Aug 13 '19 at 20:29

4

I wish it was as easy as:

dsget user "objectSID={thesid},CN=Users,DC=domain,DC=com" -samid

But it's not; AD stores the objectSID as hexadecimal.

The folks on serverfault have written a few answers that may help, though:

Retrieve user details from Active Directory using SID

edited Aug 13 '19 at 20:29

Jossef Harush Kadouri

451
5
11

answered Aug 17 '11 at 10:39

quux

5,358
1
23
36

You can with: `dsquery * domainroot -filter "(objectSid=S-1-5-21-blah-blah-blah-500)"` – user2871239 Mar 19 '19 at 15:37

score 1 · Answer 3 · answered Apr 26 '13 at 22:42

I see this one is old, but you can do this in ADUC by going to Custom Search and clicking on the advanced tab.

LDAP query string is: (objectSID=SID)

Replace "SID" with the SID that you're looking for.

I've had to do translations from SID to name and back to SID (for foreign security principals) in PowerShell using the following code:

function Find_By_SID($SID) {

    //Searches Active Directory by SID
    //Returns NetBios Name 
    // Example output: CONTOSO\User1

    $account = New-Object Security.Principal.SecurityIdentifier("$SID")
    $netbios = $account.Translate([Security.Principal.NTAccount])

    return $netbios.Value

}

score 1 · Answer 4 · answered Mar 19 '19 at 15:36

It is to search by SID using an LDAP query. For example:

dsquery * domainroot -filter "(objectSid=S-1-5-21-blah-blah-blah-500)"

or, in PowerShell,

Get-ADuser -LDAPFilter '(objectSid=S-1-5-21-blah-blah-blah-500)'

will get the domain Administrator account, if you sub in your domain value for blah-blah-blah.

How to get (AD) LDAP person entry by SID?

4 Answers4