3

I am running the below command from PowerShell:

Get-ADUser -Server ad.com -Filter '*' -Properties '*' Export-Csv 'C:\Users\myFolder\file.csv' -NoTypeInformation -Delimiter '|'

Just trying to identify the Attribute which I can use as a 'Primary Key' such as EmployeeID or EmployeeNumber. AD Attributes List: [link] Does AD provide a Primary Key?

2
  • Can you describe your use case? There are several fields to choose from. Oct 23, 2018 at 12:15
  • I am trying to identify a 'primary key' & 'modified timestamp' which I can use to update a Hive table every day whilst pulling of all the records from AD using Get-ADUser -Server ad.com -Filter '' -Properties ''. The AD output provides the following attribute "modifyTimeStamp" which I can use for Data column, but I am unable to find the best Primary key that I can use.
    – Pavan_Obj
    Oct 23, 2018 at 21:07

2 Answers 2

9

If you need a unique value in user and group entries you can look at attribute objectSID. The LDAP string representation is an OctetString but you can find code to convert this into a ASCII-clean so-called SDDL representation.

Note that SIDs contain the domain's SID as prefix. So in case the domain gets migrated new SIDs are generated and old SIDs are placed in attribute sIDHistory until cleaned up by the AD admins.

However if you're looking for a primary key to sync data with an external data source I'd create the unique value in this external data source and place it in employeeID or employeeNumber.

While many other attributes have to be unique some are not really stable or local and thus not suitable e.g. for syncing data:

objectGUID is globally unique because it is a UUID (see RFC 4122) encoded as OctetString. But IIRC it is not stable across replicas.

samAccountName and userPrincipalName are often derived from person names. The entry's RDN in AD is also based on cn which most times contains the person's name. Values derived from person's name will likely be changed after marriage/divorce etc.

=>

  • The best attribute for syncing is a self-generated ID (e.g. an UUID).
  • The 2nd best attribute is objectSID used in combination with sIDHistory for locating the entry. Make sure to sync back current value of objectSID to your data source.
2
  • So, Michael, you're saying that objectGUID is the best attribute to consider as Unique Key, as per my below trying: I am trying to identify a 'primary key' & 'modified timestamp' which I can use to update a Hive table every day whilst pulling of all the records from AD using Get-ADUser -Server ad.com -Filter '' -Properties ''. The AD output provides the following attribute "modifyTimeStamp" which I can use for Data column, but I am unable to find the best Primary key that I can use.
    – Pavan_Obj
    Oct 23, 2018 at 21:22
  • No. I said objectSID is the best attribute for syncing along with looking at sIDHistory to even survive domain migrations. Oct 24, 2018 at 7:39
8

It is pretty well documented if you look.

Distinguished name is the primary key. As a hierarchical database, the full path to the object with the canonical name must be unique in the forest.

samAccountName and userPrincipalName must also be unique across security principals in a domain.

objectSID is unique across the domain.

objectGUID is globally unique.

That said, I have seen oddball situations where the user principal name or samAccountName are duplicated, but that causes problems because the system assumes they must be unique.

EmployeeNumber is a user specified property. It's intended to be populated with the id from your user database or HR database to keep demographic and organizational data up to date. The attribute itself has no constraints.

5
  • There are some caveats with all these unique attributes. I've added more text to my answer discussing this. Feedback welcome. Oct 23, 2018 at 5:55
  • Note that userPrincipalName is unique across a whole AD forest too (if you have multiple domains in your forest). Oct 23, 2018 at 12:14
  • Yes, Gabriel, I've Multiple Domains and userPrincipalName would be unique for all of them?
    – Pavan_Obj
    Oct 23, 2018 at 21:18
  • So Bacon, you're saying that ObjectGUID is best to use as a Primary key?
    – Pavan_Obj
    Oct 23, 2018 at 21:20
  • 1
    @Pavan_Obj It depends. The only advantage objectGuid gives you is that it can never change, but do you care? userPrincipalName is guaranteed unique and is human readable, but can be changed (like if the person changes their name). Oct 23, 2018 at 21:44

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.