Using PowerShell to find objects via SidHistory

I’m using the free Quest CMDLets (www.quest.com) for this post as they do most of the heavy lifting I require under the hood. You can download these for free at Quest.com and get free support from some of the best PowerShell MVP’s as well as the CMDlet’s developers at www.PowerGui.org

SIDHistory is used extensively during migrations, however sometimes you may run into the scenario where SIDHistory is written incorrectly or you want to find an object in the target based on the source objects SID.

In those cases it’s really useful to be able to search the target forest or domain in order to find the object on which the source user or groups SID is written as SIDHistory.

To be explicit in this example I’m going to specify the full DN of the source object I’m trying to find in the Target forest.

The Syntax above is

(Get-QADobject “DN”).sid.value

in order to return the text value of the SID. Note that you could have assigned the value to a variable as follows:

$sid = (Get-QADObject “DN”).sid.value

The next thing to do is run a search specifying the returned SID as an LDAP search filter (Sidhistory=SIDtosearchfor)

The syntax above is

Get-QADObject –LdapFilter ‘(sidhistory=SIDtosearchfor)’ | fl name, type, DN, Samaccountname

Which searches the directory for all objects with SIDHistory, and returns a formatted list including the objects name, type, Distinguished Name and samaccountname.