Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I accidentally deleted a user account, and need to recreate it with the same SID. I've created a new user account with the same name, but how do I edit the objectSid attribute? ADSIEDIT errors with "Access to the attribute is not permitted because the attribute is owned by the Security Accounts Manager (SAM)". Any other methods?

share|improve this question
I'm giving rep to this question because even though it's something you can't do and shouldn't try, it's a good one and an important point to highlight. :) – Le Comte du Merde-fou Aug 13 '09 at 13:15
up vote 8 down vote accepted

You can't. You have to do an authoritative restore of the user account in order to get a user back. Have a look at this Technet article.

share|improve this answer
Got there before me! – Le Comte du Merde-fou Aug 13 '09 at 13:07
Thanks, I will try this instead. Do you know of any way to perform this without rebooting the DC? – Bob Robertson Aug 13 '09 at 13:10
Please ignore last comment. I found a way to reboot remotely into DS REPAIR mode so it's ok. – Bob Robertson Aug 13 '09 at 13:14

I know this question has been answered, but for the future you may also look at the tools out there like Quest's Recovery Manager for Active Directory. If you have a system state backup it can recover the object without a reboot of the DC. They've been known to work with folks in a situation like yours to try and get you up and running in hopes of getting a sale. Better, though, is to already have it licensed and in place in case there's a major issue, like someone deleting an OU or something drastic like that.

share|improve this answer
+1, good suggestion. Also investigate if your standard backup software can do granular AD restores. – Le Comte du Merde-fou Aug 13 '09 at 16:30
+1 here also. I'll attest to Quest's excellent pre-sale support. I use their LiteSpeed product for SQL Server backups and my rep has bent over backward for me prior to receiving our PO. – squillman Aug 14 '09 at 11:47

The answer I'm afraid is "you don't". A good writeup of what SIDs are, what they're used for and how they work is here: which should make the reasons why obvious.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.