How to find SID History?

[Rebecca Chen [MSFT]]

Hello,

When you view the sIDHistory attribute in Active Directory using an LDAP
tool such as LDP.exe, the attribute will look something like the following:

1> sIDHistory: S-1-5-21-1619521004-1441481110-1935294565-1315;

If you see an attribute on the user account that looks like the preceding
example, then the SID History is present. If the attribute is missing or is
marked as "Not set" (if you are viewing it using ADSI Edit, for example),
the SID History was not migrated for that specific account.

I believe that the below article can answer your question.

What Exchange Administrators Need to Know About the Active Directory
Migration Tool:
http://www.microsoft.com/technet/prodtechnol/exchange/2003/admt.mspx


The command Getsid.exe is used to compares the user security identifiers of
two accounts. Windows 2k3 supports Getsid.exe, and you can use this command
to see the user account SID. The useage is : getsid \\mydc accont1 \\mydc
accout2
You will see the SID of accont1 and account2.

For more details, Please refer to the following article:

Getsid.exe: Get Security ID
http://www.microsoft.com/resources/documentation/WindowsServ/2003/all/techre
f/en-us/Default.asp?url=/Resources/Documentation/windowsserv/2003/all/techre
f/en-us/getsid.asp


Getsid.exe can be download from the following link:

http://www.microsoft.com/windows2000/techinfo/reskit/tools/existing/getsid-o
.asp

If you have any questions, please feel free to let me know.

Have a nice day!

Best regards,

Rebecca Chen

MCSE2000 MCDBA CCNA


Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security

=====================================================

When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.

=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

[SBSM]

Hi Rebecca,
Thank You for the reply. Actually, we are a SI and doing a large migration
project consolidating 3 different domains. So, we have close to 200+
duplicated accounts created by ADC out of 3000 migrated account.

So, I was wondering a better way to clean up the disabled accounts. Any my
customer would like us to show him that the SID is migrated successfully. Any
way thank you.

Regards,
SBSM

Hi SBSM,
The format in ldp.exe should be decimal by default. Please refer to my
screen shot.
The format in adsiedit.msc should be Hex by default. Choose Decimal in
ADSI, the format is different as we can see in ldp.exe. This depends on the
data format saved in ADSI.
With regards to the script, unfortunately, script is not supported in this
newsgroup. Please post this question to MSDN newsgroup since their main
focus is in the development field.
http://msdn.microsoft.com/newsgroups/default.asp
Is there any special reason to read and compare the SID history in Decimal?
Technically speaking, SID history is temporarily during the migration
period and we don't need to read the SID history.
Have a great day!
Best regards,
Rebecca Chen
MCSE2000 MCDBA CCNA
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights

[Rebecca Chen [MSFT]]

Hi SBSM,

I recommend you use a third-party tool named mytoken to read the SID
history. The SID history is perfectly displayed as Decimal.

If you can not download mytoken from the Internet, please directly send
email to v-***@microsoft.com and I will send it to you.

With regards to the script, I am afraid to say you need to contact MSDN to
achieve the goal.

Any update, please keep in touch!


Best regards,

Rebecca Chen

MCSE2000 MCDBA CCNA


Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security

=====================================================

When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.

=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.