Foreign Security principal

[Bob]

I just started at a company so I have no history of their
domains. I have noticed that there are a number of
external trusts and have tracked these down to NT 4
Domains. My predesessor set up external trusts to these
domains as would be expected. However, in the foreign
security principal OU I have, as I would expect only
object SIDs. My boss wants me to determine where these
foreign security principals came from. Does anyone know
how and if this can be done?

 

[Joe Richards [MVP]]

If you look at the container through ADUC it will resolve any of them that it
knows how to resolve (i.e. trusts are still in place and accounts still exist).

You can also write a script that will dump the sids to a file and then loop
through them and try to resolve them, there is a free tool on my website called
sidtoname that will convert sids to names if the sid is resolvable.

 

[Joe Richards [MVP]]

If you look at the container through ADUC it will resolve any of them that it
knows how to resolve (i.e. trusts are still in place and accounts still exist).

You can also write a script that will dump the sids to a file and then loop
through them and try to resolve them, there is a free tool on my website called
sidtoname that will convert sids to names if the sid is resolvable.