Query for AD user using string (or Hex) version of objectSID

[greg0303]

I want to run a query on AD to find what user has a SID. If I have the string version of the SID (ie S-1-5-21-427426699-165134457-1240836222-8649). So my query would consits of:
"<" & oConfig.adspath & ">;(&(objectCategory=person)(objectClass=User)(objectSid=S-1-5-21-427426699-165134457-1240836222-8649));name,canonicalName,distinguishedName,info;subtree"

However I can not get any results. I have tried using the Hex version of the SID but could not query with that either. Anyone know of a way to do this?

 

[tsuji]

>(&(objectCategory=person)(objectClass=User)(objectSid=S-1-5-21-427426699-165134457-1240836222-8649));
You should use escaped form of sid's hexstring format on the filter, like this.
[tt](&(objectCategory=person)(objectClass=User)(objectSid=\01\05\00\00\00\00\00\05\15\00\00\00\8B\03\7A\19\79\C0\D7\09\7E\A8\F5\49\C9\21\00\00));[/tt]

 

[markdmac]

I think it might be easier to use WMI for this. Here is a sample.

UserSID = "S-1-5-21-1443548379-341315553-1914419632-1106"
Set wmiService = GetObject("winmgmts:{impersonationLevel=Impersonate}")
Set wmiSID = wmiService.Get("Win32_SID.SID='" & UserSID & "'")

Wscript.Echo "Win32_SID Properties"
Wscript.Echo "--------------------"
Wscript.Echo "AccountName:          " & wmiSID.AccountName
Wscript.Echo "ReferencedDomainName: " & wmiSID.ReferencedDomainName
Wscript.Echo "SID [String]:         " & wmiSID.SID

The above gives me the following output on my own domain.

Microsoft (R) Windows Script Host Version 5.7
Copyright (C) Microsoft Corporation. All rights reserved.

Win32_SID Properties
--------------------
AccountName: markdmac
ReferencedDomainName: SPIDERSPARLOR
SID [String]: S-1-5-21-1443548379-341315553-1914419632-1106


***** script completed *****

You could break it down further to just the following:

UserSID = "S-1-5-21-1443548379-341315553-1914419632-1106"
Set wmiService = GetObject("winmgmts:{impersonationLevel=Impersonate}")
Set wmiSID = wmiService.Get("Win32_SID.SID='" & UserSID & "'")

UserName = wmiSID.AccountName

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.