Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 2 down vote favorite

I wanted to know if there is either an auto-populated field or a field that we could populate at creation time with a unique ID number for accounts that we could query for.

The reason I ask for this is that we need an LDAP query for user accounts that will persist after account renames.

share|improve this question
1  
If your users are employees, you can populate the employeeID attribute from your HR system. – jscott Apr 13 '12 at 16:12

1 Answer

up vote 6 down vote accepted

You could use the SID (objectSID) for this. It will persist unless a new account is created or the accounts are migrated to a different domain.

If you want something smaller you could actually just use the last group of numbers from the SID, assuming only one domain, as the three prior ones are just to identify the domain, and the block before that is just to show it is a windows AD SID.

You could also use objectGUID for this, I suppose.

share|improve this answer
2  
SID is th way to go however the answer says that the sid will not persist when migrated. That's not quite correct. The old Sid from the source domain is migrated to the sid-history attribute during each migration – Jim B Apr 13 '12 at 16:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.