Active Directory Object Movement with SID Retention

Products

• CA Identity Suite
• CA Identity Manager
• CA Identity Portal
• CA Identity Governance

Issue/Introduction

Moving Active Directory (AD) accounts between Organizational Units (OUs) using standard Identity Manager roles typically involves a delete and recreate operation. This process results in a new Security Identifier (SID) for the object, which can break existing permissions or resource access.

This article provides the procedure to move an account while preserving its original SID using the specialized ldapmodrdn.exe utility.

Environment

Identity Manager

Resolution

To move an AD account without destroying its SID, use the special version of ldapmodrdn.exe included with the Identity Manager Provisioning Server.

Use the -s parameter to specify the new superior entry

Key Parameters:

• -r: Remove old RDN (recommended).
• -s newsup: Specifies the New Superior entry (the target OU DN).
• -h / -p: Provisioning Server host and port (default 20389).
• -D / -w: Bind DN and password for an administrator.

Example Batch Execution

set HOST=prov_server_hostset PORT=20389set BINDDN="eTGlobalUserName=admin,eTGlobalUserContainerName=Global Users,eTNamespaceName=CommonObjects,dc=example,dc=eta"set PWD=passwordset NEWSUPDN="eTADSOrgUnitName=Disabled Users,eTADSOrgUnitName=Example,eTADSDirectoryName=MyAD,eTNamespaceName=ActiveDirectory,dc=example,dc=eta"set OBJECTDN="eTADSAccountName=user1,eTADSOrgUnitName=Standard Users,eTADSOrgUnitName=Example,eTADSDirectoryName=MyAD,eTNamespaceName=ActiveDirectory,dc=example,dc=eta"set RDN="eTADSAccountName=user1"
"%ETAHOME%\Bin\ldapmodrdn.exe" -h %HOST% -p %PORT% -D %BINDDN% -w %PWD% -s %NEWSUPDN% %OBJECTDN% %RDN%