up vote 3 down vote favorite
share [g+] share [fb]

I accidentally deleted a user account, and need to recreate it with the same SID. I've created a new user account with the same name, but how do I edit the objectSid attribute? ADSIEDIT errors with "Access to the attribute is not permitted because the attribute is owned by the Security Accounts Manager (SAM)". Any other methods?

link|improve this question
I'm giving rep to this question because even though it's something you can't do and shouldn't try, it's a good one and an important point to highlight. :) – mh. Aug 13 '09 at 13:15
feedback

3 Answers

up vote 5 down vote accepted

You can't. You have to do an authoritative restore of the user account in order to get a user back. Have a look at this Technet article.

link|improve this answer
Got there before me! – mh. Aug 13 '09 at 13:07
Thanks, I will try this instead. Do you know of any way to perform this without rebooting the DC? – Bob Robertson Aug 13 '09 at 13:10
Please ignore last comment. I found a way to reboot remotely into DS REPAIR mode so it's ok. – Bob Robertson Aug 13 '09 at 13:14
feedback
up vote 2 down vote

I know this question has been answered, but for the future you may also look at the tools out there like Quest's Recovery Manager for Active Directory. If you have a system state backup it can recover the object without a reboot of the DC. They've been known to work with folks in a situation like yours to try and get you up and running in hopes of getting a sale. Better, though, is to already have it licensed and in place in case there's a major issue, like someone deleting an OU or something drastic like that.

link|improve this answer
+1, good suggestion. Also investigate if your standard backup software can do granular AD restores. – mh. Aug 13 '09 at 16:30
+1 here also. I'll attest to Quest's excellent pre-sale support. I use their LiteSpeed product for SQL Server backups and my rep has bent over backward for me prior to receiving our PO. – squillman Aug 14 '09 at 11:47
feedback
up vote 0 down vote

The answer I'm afraid is "you don't". A good writeup of what SIDs are, what they're used for and how they work is here: http://technet.microsoft.com/en-us/library/cc961998.aspx which should make the reasons why obvious.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard