Given a user's SID, how can I get the AD DirectoryEntry?

Question

I have the user's SID as byte[] within windowsPrincipal.getIdentity().getSid(). How can I get an Active Directory entry (DirectoryEntry) from the SID?

Answer 1

The easiest way I've found is using LDAP binding. Similar to what Nick Giles said. More info at MSDN

''' <summary>
''' Gets the DirectoryEntry identified by this SecurityIdentifier.
''' </summary>
''' <param name="id">The SecurityIdentifier (SID).</param>
<System.Runtime.CompilerServices.Extension()> _
Public Function GetDirectoryEntry(ByVal id As SecurityIdentifier) As DirectoryEntry
    Const sidBindingFormat As String = "LDAP://AOT/<SID={0}>"

    Return New DirectoryEntry(String.Format(sidBindingFormat, id.Value))
End Function

Answer 2

This can also be done in PowerShell, as long as you have .Net 3.5 or 4.0 available (see https://gist.github.com/882528 if you don't by default)

add-type -assemblyname system.directoryservices.accountmanagement
$adPrincipalContext = 
    New-Object System.DirectoryServices.AccountManagement.PrincipalContext( 
    [System.DirectoryServices.AccountManagement.ContextType]::Domain)
$user = [system.directoryservices.accountmanagement.userprincipal]::findbyidentity(
    $adPrincipalContext
    , [System.DirectoryServices.AccountManagement.IdentityType]::Sid
    , "S-1-5-21-2422933499-3002364838-2613214872-12917")
$user.DisplayName
$user.DistinguishedName