Accessing Foreign Security Principals

Question

Searching for the user michael@mycontoso.com with the objectSid S-1-5-21-1234567890-123465789-123456789-123456, I only find a Foreign Security Prin

Answer 1

You may try to retrieve the msDS-PrincipalName:

ldapsearch  -b "CN=ForeignSecurityPrincipals,DC=contoso,DC=com" "CN=S-1-5-21-1234567890-123465789-123456789-123456" msDS-PrincipalName

FOO\michael@mycontoso.com

---

Otherwise, the approach is as https://stackoverflow.com/a/27038494/10408280 describes:

1. Retrieve Domain identifier from first part of SID
2. Perform a lookup against that domain for the SID of the user or by sAMAccountName