Skip to main content

Removing sIDHistory attribute


When using PowerShell Commands for Active Directory modifications on AD objects are scripted easily.
But dealing with some properties (e.g., sIDHistory) requires a special approach.

Let's say we need to clear the sIDHistory for the account TEST01
This account does have the sIDHistory attribute populated



[PS] C:\>$user=Get-QADUser -SamAccountName TEST01  -IncludedProperties sidhistory


[PS] C:\>$user.sIDHistory
0105000000000005150000002B012212B316AD0EEE04CFAD576F1600


If we want to clear an attribute like DisplayName we can use Set-QADUser and set the attribute to $null like this:


[PS] C:\>Set-QADUser $user -ObjectAttributes @{DisplayName=$null}


Name                    Type            DN
----                    ----            --
Test01,User             user            CN=Test01, User...

or that

[PS] C:\>Set-QADUser $user -ObjectAttributes @{DIsplayName=@{delete=$user.DisplayName}}


Name                    Type            DN
----                    ----            --
Test01,User             user            CN=Test01, User...



But what happens when we try the same syntax for sIDHistory:


[PS] C:\>Set-QADUser $user -ObjectAttributes @{sidhistory=$null}
Set-QADUser : General access denied error
At line:1 char:12
+ Set-QADUser  <<<< $user -ObjectAttributes @{sidhistory=$null}
[PS] C:\>



This didn't work. Let's try the second option.

[PS] C:\>Set-QADUser $user -ObjectAttributes @{sidhistory=@{delete=$user.sidhistory}}
Set-QADUser : The specified directory service attribute or value does not exist
. (Exception from HRESULT: 0x8007200A)
At line:1 char:12
+ Set-QADUser  <<<< $user -ObjectAttributes @{sidhistory=@{delete=$user.sidhistory}}

we got a different error. At least it doesn't complain anymore about the permissions. But how can we specify sIDHistory? If we check the property of the object with get-member we'll find out that

sIDHistory                    NoteProperty          System.String sIDHistory..

is a NoteProperty and as such it needs to be referenced as  $user['sidhistory'] (it's case-insensitive).

And after that we can finaly clear the sIDHistory attribute

[PS] C:\>Set-QADUser $user -ObjectAttributes @{sidhistory=@{delete=$user['sidhistory']}}


Name                    Type            DN
----                    ----            --
Test01,User             user            CN=Test01, User...



Comments

Post a Comment

Popular posts from this blog

Joining Windows 10 to Azure AD Domain

As of October 2016 to join Windows 10 computers to Azure AD Domain service requires these steps: Create a VNET in the classic portal . The VNET must be placed to a region where Azure AD domain service is available (( https://azure.microsoft.com/en-us/regions/services/ )  In the classic portal  go to Directory -> Configure and enable the domain service. And wait for ~ 30 min When completed the IP address will be populated Go back to the VNET configuration and add a DNS server with the IP (10.0.0.4 in this case) Create the "AAD DC Administrator" administrators group (again in Directory -> Group). Members of this group are granted administrative privileges on machines that are domain-joined to the Azure AD Domain Services managed domain. Add to the group your users who are supposed to have the administrative access on a Windows 10 computer go to Settings -> Accounts (this is true for Windows 10 version  1607) then select 'Access work
1 comment
Read more

Create 3-Node Windows 2012 Multi-subnet Cluster

Environment There are two Data centers connected via a WAN link. Two Windows 2012 Servers (called SQLDEV1 and SQLDEV2) are located in the Primary Data Center (on the IP subnet 192.168.79.0/24) and the third server is placed in the Secondary Data Center with the 192.168.69.0/24 subnet. We’ll be creating a three-node Windows cluster with no shared storage on the multi subnet network with a file share witness at the Primary Data Center. We’ll be using a file share witness to protect from the cluster failure in a situation when the network between the Data Centers is unavailable and one of the servers in the Primary Data Center is also down (or being rebooted). The final state will look like depicted above: -           Two Virtual IP’s will be assigned (192.168.76.218 and 192.168.69.134) to the cluster -           The servers at the Primary Data Center will have a vote (Vote=1) and the server at the Secondary Data Center will have no vote (Vote=0). The file share witness al
2 comments
Read more

Generate Calendar Table in Power BI with Fiscal Year Attributes

In Power BI go to Get Data --> Blank Query and paste into the Function windows the text below. This function takes as parameters: - StartYear (e.g., 2012) - EndYear (e.g., 2018) -FiscalYearStartMonth (e.g., 4) And it will generate a calendar table for dates from Jan-1-<StartYear> till Dec-31-<EndYear> and columns for Fiscal Year, Fiscal Month, Fiscal Quarter, Fiscal Year Day where the Fiscal year begins on FiscalYearStartMonth = (StartYear as number, EndYear as number, FiscalYearStartMonth as number)=> let     //Capture the date range from the parameters     StartDate = #date(StartYear, 1, 1),     EndDate = #date(EndYear, 12, 31), //Get the number of dates that will be required for the table     GetDateCount = Duration.Days(EndDate - StartDate)+1, //Take the count of dates and turn it into a list of dates     GetDateList = List.Dates(StartDate, GetDateCount,     #duration(1,0,0,0)), //Convert the list into a table     DateListToTable
2 comments
Read more