Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I wanted to know if there is either an auto-populated field or a field that we could populate at creation time with a unique ID number for accounts that we could query for.

The reason I ask for this is that we need an LDAP query for user accounts that will persist after account renames.

share|improve this question
If your users are employees, you can populate the employeeID attribute from your HR system. – jscott Apr 13 '12 at 16:12
up vote 6 down vote accepted

You could use the SID (objectSID) for this. It will persist unless a new account is created or the accounts are migrated to a different domain.

If you want something smaller you could actually just use the last group of numbers from the SID, assuming only one domain, as the three prior ones are just to identify the domain, and the block before that is just to show it is a windows AD SID.

You could also use objectGUID for this, I suppose.

share|improve this answer
SID is th way to go however the answer says that the sid will not persist when migrated. That's not quite correct. The old Sid from the source domain is migrated to the sid-history attribute during each migration – Jim B Apr 13 '12 at 16:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.