Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I accidentally deleted a user account, and need to recreate it with the same SID. I've created a new user account with the same name, but how do I edit the objectSid attribute? ADSIEDIT errors with "Access to the attribute is not permitted because the attribute is owned by the Security Accounts Manager (SAM)". Any other methods?

share|improve this question
    
I'm giving rep to this question because even though it's something you can't do and shouldn't try, it's a good one and an important point to highlight. :) –  Darth Melkor Aug 13 '09 at 13:15

3 Answers 3

up vote 6 down vote accepted

You can't. You have to do an authoritative restore of the user account in order to get a user back. Have a look at this Technet article.

share|improve this answer
    
Got there before me! –  Darth Melkor Aug 13 '09 at 13:07
    
Thanks, I will try this instead. Do you know of any way to perform this without rebooting the DC? –  Bob Robertson Aug 13 '09 at 13:10
    
Please ignore last comment. I found a way to reboot remotely into DS REPAIR mode so it's ok. –  Bob Robertson Aug 13 '09 at 13:14

I know this question has been answered, but for the future you may also look at the tools out there like Quest's Recovery Manager for Active Directory. If you have a system state backup it can recover the object without a reboot of the DC. They've been known to work with folks in a situation like yours to try and get you up and running in hopes of getting a sale. Better, though, is to already have it licensed and in place in case there's a major issue, like someone deleting an OU or something drastic like that.

share|improve this answer
    
+1, good suggestion. Also investigate if your standard backup software can do granular AD restores. –  Darth Melkor Aug 13 '09 at 16:30
    
+1 here also. I'll attest to Quest's excellent pre-sale support. I use their LiteSpeed product for SQL Server backups and my rep has bent over backward for me prior to receiving our PO. –  squillman Aug 14 '09 at 11:47

The answer I'm afraid is "you don't". A good writeup of what SIDs are, what they're used for and how they work is here: http://technet.microsoft.com/en-us/library/cc961998.aspx which should make the reasons why obvious.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.