Search AD by GUID

Question

How do I search Active Directory for objects by GUID? In other words, what would be a good way to find what objects belong to specified GUIDs?

http://serverfault.com/questions/140683/get-an-object-by-its-objectguid-using-ldapsearch Provides one method. — sysadmin1138, Sep 12 '11 at 16:51

score 21 · Accepted Answer · answered Sep 12 '11 at 17:41

21

Either on a DC or install RSAT and enable AD Tools:

Open "Active Director Module for Windows PowerShell" (find it in with the other Admin tools)

get-aduser -id {guid}

Or for any object:

get-adobject -id {guid}

Might want to pipe it through a format-list to make it readable:

get-adobject -id {guid} | fl

answered Sep 12 '11 at 17:41

Chris S

77,945
11
124
216

2

+1, simplest answer with native tools. If you're at a regular powershell prompt and don't want to open the AD Module for PS in the start menu you can just run `import-module ActiveDirectory` and all of the same cmdlets will be available in your powershell session. – MDMarra Sep 12 '11 at 17:57

score 3 · Answer 2 · answered Sep 12 '11 at 16:44

Using Powershell and the QuestAD cmdlets, the following code returns my user account based on my guid.

$Guid = "d65e4578-475a-422e-ac99-123456789012"

Get-QADUser -IncludeAllProperties|Where {$_.guid -eq $Guid}

Not the most efficient manner since it loads all objects from AD while doing the search, but it worked for me.

score 1 · Answer 3 · answered Jun 19 '23 at 16:06

ADSI is installed by default on Windows.

Does not require installing any additional modules.

Powershell Example:


# define constants
$LDAPserver = "DeathStar.Empire.Galactic"
$GetItem  = "GUID=d65e4578-475a-422e-ac99-123456789012"

# use this if you have a SID
# $GetItem  = "SID=S-1-1-555-423432-437584356"

# Get the Distinguished Name
$DistinguishedName = $([ADSI]"LDAP://$($LDAPserver)/<$($GetItem)>").DistinguishedName

# Use the distinguished name to fetch the actual object
$Searcher = [ADSISearcher] ([ADSI] "LDAP://$(LDAPserver)")
$Searcher.Filter = "(&(objectCategory=Person)(DistinguishedName=$($DistinguishedName)))"
$AdsiObject = $Searcher.FindAll()

# Get the ADSI object properties
$AdsiObject.properties

score 1 · Answer 4 · edited Jun 17 '16 at 14:37

1

$guid = "d65e4578-475a-422e-ac99-123456789012"

foreach ($dom in (Get-adforest).Domains) { Get-ADObject -filter {ObjectGUID -eq $guid } -Properties * -Server $dom | fl }

edited Jun 17 '16 at 14:37

Flup

7,978
2
32
43

answered Jun 17 '16 at 13:56

cblack

11
1

Search AD by GUID

4 Answers4