Search code examples
powershellfiltersid

get-adgroup -filter "SID -like '*-512'"

I have been wanting to figure out how to use -filter to get what I want. What I am trying to do is find the Domain Admins group by a -like statement of *-512 against the SID property using the following:

get-adgroup -filter "SID -like '*-512'"

It works if I put the actual SID

get-adgroup -filter "SID -eq 'S-1-5-21domain-512'"

I know doing it this way will work

get-adgroup -filter * | ? {$_.SID -like '*-512'}

https://support.microsoft.com/en-us/help/243330/well-known-security-identifiers-in-windows-operating-systems

Solution

  • As BenH comments, you cannot partially filter on SIDs in LDAP queries, because of the way SID values are stored in the directory. The SID string you see is an SDDL representation of an underlying byte array.

    I assume your motivation for attempting wildcard matching against a well-known RID is that you don't know the domain SID in advance. You can easily obtain that with the Get-ADDomain cmdlet:

    $DomainSID = (Get-ADDomain).DomainSID
$DomainAdminsSid = New-Object System.Security.Principal.SecurityIdentifier ([System.Security.Principal.WellKnownSidType]::AccountDomainAdminsSid,$DomainSID)

Get-ADGroup -Filter {SID -eq $DomainAdminsSid}