2

I need a way to identify users that won't change if our e-mail or username naming conventions change; they have in the past. We use LDAP, but our international offices use Active Directory, so I'm a little green here.

I've noticed from a dump that all users have a unique value assigned to uSNCreated. Is this globally unique for a user? Will it change if any of their properties change? Is this my holy grail of unique identifiers for AD?!

| improve this question | | | | |
2

Why not use the value that Microsoft uses - the SID? This is stored as a binary in the objectSid attribute. Another benefit of this is that should your users be moved between domains in the future, the objectSid will be stored in sIDHistory so you can reconcile the changes.

| improve this answer | | | | |
  • Hmm... One of my AD setups has the objectSid field per user, the other has something called objectGUID. Our LDAP server has neither :P Fun times! – RandomInsano Aug 11 '10 at 17:06
  • 1
    AD should have both objectSid and objectGuid. – Doug Luxem Aug 11 '10 at 17:08
2

@sysadmin1138's answer is a little misleading. uSNCreated is not related to time; it is unique only on the DC. It is the DC's "highestCommittedUsn + 1" at the time of object creation. He is probably mixing it up with whenCreated, which is a 64-bit number representing the number of 100 nanosecond intervals since 12:00 am January 1, 1601...and also not necessarily unique. He is however correct that objectGuid, along with objectSid, are best used to track objects through attribute changes. Both are always set on all user objects and will never change w/o deleting and recreating the object...at which time all bets are off for tracking the object!

| improve this answer | | | | |
1

That field is actually a sneaky date-time field and is not guaranteed to be unique. A better field for this is 'objectGUID'. That IS unique.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.