up vote 0 down vote favorite
share [g+] share [fb]

Given the SID of a user or a group, how can I find a LDAP object that belongs to it?
LDAP Server ist Active Directory (Windows Server 2008).

A LDAP query String would be useful.

link|improve this question
1  
This table should help you, i know it helped me alot. kouti.com/tables/userattributes.htm – Sirex Aug 17 '11 at 9:18
Hi Sirex, thanx for your comment. In the table you sent I saw that the attribute objectSid mandatory ist. But I do not see it as attribute in my ldap database. Why? – mtm Aug 17 '11 at 11:33
@mtm That's because the objectSID attribute is from the Active Directory schema, it is not defined in the LDAP Schema. – jscott Aug 17 '11 at 12:00
@jscott, I access my ldap database with "Apache Directory Studio", and see the attribute "objectSID" only by groups, and not by users. What could be the reason of it? – mtm Aug 17 '11 at 12:14
feedback

2 Answers

up vote 1 down vote accepted

I wish it was as easy as:

dsget user "objectSID={thesid},CN=Users,DC=domain,DC=com" -samid

But it's not; AD stores the objectSID as hexadecimal.

The folks on serverfault have written a few answers that may help, though:

Retrieve user details from Active Directory using SID

link|improve this answer
feedback
up vote 1 down vote

Another way would be to forsake LDAP and use WMIC:

H:\>wmic useraccount where (sid = "S-1-5-21-1698188384-1693678267-1543859470-6637") get * /format:list    

AccountType=512
Caption=MYDOMAIN\quux
Description=some guy's account
Disabled=FALSE
Domain=MYDOMAIN
FullName=Some Guy
InstallDate=
LocalAccount=FALSE
Lockout=FALSE
Name=quux
PasswordChangeable=TRUE
PasswordExpires=FALSE
PasswordRequired=TRUE
SID=S-1-5-21-1698188384-1693678267-1543859470-6637
SIDType=1
Status=OK

Now you have several attributes that should be easy to search via LDAP, if you still need to.

link|improve this answer
Hi quux, thank you! I cannot use command line tools.need a LDAP query for . – mtm Aug 17 '11 at 11:44
I cannot use command line tools. I get the SID in a programm and should use the SID-value (in some LDAP query) in order to get DirectoryEntry Object. – mtm Aug 17 '11 at 11:47
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.