Forum Discussion

midiman810new's avatar
midiman810new
Brass Contributor
Oct 25, 2024

How can I return all AD Groups with a specific SID HISTORY value?

Hello how can I return all AD Groups with a specific SID HISTORY value?    I have tried something like this    $SID = "SID VALUE Here" Get-ADGroup -Filter * | where{$_.sidhistory -eq $SID}  But...
@Windows PowerShell
LainRobertson's avatar
LainRobertson
Silver Contributor
Oct 26, 2024

midiman810new 

 

Hi, Leon.

 

There's two "issues" with your current command:

 

  1. You haven't specified that sIDHistory is included in the search results (only relevant in client-side filtering);
  2. You're performing client-side filtering rather than server-side.

 

Because you have not specified that the siDHistory attribute is to be included in the results, your "where" clause (i.e. client-side filtering) has nothing to compare $SID to (i.e. $_.sidhistory is always $null), meaning your "$_.sidhistory -eq $SID" statement will always evaluate to $false.

 

If you use server-side filtering, this is not an issue. Additionally, it will perform significantly faster than client-side filtering - depending on how large your Active Directory environment is.

 

Try the following instead:

 

$SID = "SID VALUE Here";
Get-ADGroup -Filter { (siDHistory -eq $SID) };

 

Note: In using server-side filtering, there's no need to specify siDHistory as an additional attribute to include in the query results via "-Properties siDHistory".

 

Cheers,

Lain

Resources