SIDHistory stores previous SIDs on migrated accounts and can create unexpected access paths across domains or after migrations. We query it when trust relationships, migrated users, or unusual authorization behavior are in scope.
export DC=10.10.10.200
export BASE='DC=ootw,DC=local'
export DOMAIN=ootw.local
export USER='student'
export PASS='student'
Accounts with SIDHistory:
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(sIDHistory=*)' name sAMAccountName objectSid sIDHistory memberOf distinguishedName
Search by object SID:
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(objectSid=S-1-5-21-3926355307-1661546229-813047887-6102)' samAccountType distinguishedName sAMAccountName objectSid
PowerShell:
Get-ADObject -LDAPFilter '(sIDHistory=*)' -Properties sIDHistory,objectSid,sAMAccountName,memberOf |
Select-Object Name,ObjectClass,sAMAccountName,ObjectSid,SIDHistory,MemberOf