Duplicate SID in Active Directory.

Question

Hi.

I have two users in Active Directory with the same SID. How is this possible and what should I do?

ntdsutil "sec acc man" "co to se msk-dc-01" "check dup sid" q q - command returns an empty file

Answer 1

Hi,

Your correct it shouldn't be possible, but as there's an option in ntdsutil to check and repair it, MS must have thought it was a possibility!

Each DC has it's own unique RID pool allocation, which it uses to get the next available RID to create the SID. You can use this tool to check the pool allocations https://nettools.net/rid-pool/ and see if there is any overlaps in the allocated pools.

As ntdsutil is not finding any duplicates, I would first confirm the details of each account and what SID and SID History is allocated to each account using ADSIEdit, in case the machine you are running powershell on is doing something strange with the name resolution. I would also do a reverse lookup of the SID to see which account the DC will return. I would also do an LDAP search for the SID to see if both accounts are returned. I would also check the creation date on both account to see if they were created at the same time.

Another option if none of the above help, you could dump the database, and see if there are any duplicates, the details on how to do this are here , this is the query to dump the SIDs

[AD: RootDSE Modify - Dump SIDs]
Options=880098929149517
Server=
BaseDN=NULL
Filter=(objectclass=*)
Attributes=dumpdatabase=="objectsid"
DisplayFilter=
Filename=
Sort=
Controls=
Authentication=1158
Separator=,