Fire up Windows PowerShell and run:

$strSID="S-1-5-21-500000003-1000000000-1000000003-1001"
$uSid = [ADSI]"LDAP://<SID=$strSID>"
echo $uSid

The output should look something like this,

distinguishedName : {CN=John Doe,OU=Domain Admins,OU=People,OU=xxx,DC=xxx}
Path              : LDAP://<SID=S-1-5-21-500000003-1000000000-1000000003-1001>

I always wrap the command in parenthesis and specify the property I want. It works for one or many objects, and is more simple than writing select -expand statements.

$SID = (Get-ADUser "Username").SID

Hello @Anne

You can extract all the SIDs in a specific domain using:

Get-ADUser -Filter * -SearchBase "dc=domain,dc=local" | select Name,SID

Hope this helps with your query,

--
--If the reply is helpful, please Upvote and Accept as answer--

As BenH comments, you cannot partially filter on SIDs in LDAP queries, because of the way SID values are stored in the directory. The SID string you see is an SDDL representation of an underlying byte array.

I assume your motivation for attempting wildcard matching against a well-known RID is that you don't know the domain SID in advance. You can easily obtain that with the Get-ADDomain cmdlet:

$DomainSID = (Get-ADDomain).DomainSID
$DomainAdminsSid = New-Object System.Security.Principal.SecurityIdentifier ([System.Security.Principal.WellKnownSidType]::AccountDomainAdminsSid,$DomainSID)

Get-ADGroup -Filter {SID -eq $DomainAdminsSid}

Meanwhile I found the solution:

Import-Module ActiveDirectory
Import-Csv C:\users.csv|foreach{
$gruppe = $item.GroupName
get-aduser $_.UserName -properties objectsid , samaccountname |select samaccountname, objectsid , @{l="GroupName";e={$item.GroupName}}
}|export-csv "C:\output.csv" -NoTypeInformation

You can do something like the following:

$domains = Get-ADForest | Select-Object -ExpandProperty Domains
$SID = 'some sid value'
$CN = 'user CN'
foreach ($domain in $domains) {
    $DC = (Get-ADDomainController -DomainName $domain -Discover).Hostname
    $User = Get-ADObject -filter "CN -eq '$CN' -and ObjectSID -eq '$SID'" -Server $DC -IncludeDeletedObjects -Credential $mycred -ErrorAction SilentlyContinue
}

Explanation:

• You can list all of your subdomains using the Get-ADForest command, and that collection is stored in $domains.
• A foreach loop can loop through each of those domains with the current domain being $domain.
• For each domain, you can query for a domain controller to store in $DC and then perform a Get-ADObject with the -IncludeDeletedObjects.
• To speed up your query, you can use the -filter switch rather than piping to Where-Object.
• You can filter on the CN and ObjectSID attributes.

Additional Considerations:

In this script, nothing is being done with the discovered data. I am not sure where you want to go from here. You will need to add some other logic like an if statement to check the value of $User. Because we are using -filter, $user will be $null if no object is found rather than throwing an error, which you will see when using Get-ADObject -Identity. From there you can do additional processing even if that means utilizing break statements.

if ($user) {
    # User was found. Process code here.
    break # Exit the foreach loop because further loop processing is not needed
}
else {
    # User was not found. Process code here
}

No output is generated in the solution because all queried data is stored in variables. The value of $DC and $User will be overwritten during each loop iteration. It may be best to store the discovered user data in a collection with a specific set of properties. You could retrieve DistinguishedName or CanonicalName along with SamAccountName and ObjectSID to know which domain and container has the user object.

$Users = foreach ($domain in $domains) {
    $DC = (Get-ADDomainController -DomainName $domain -Discover).Hostname
    Get-ADObject -filter "CN -eq '$CN' -and ObjectSID -eq '$SID'" -Server $DC -IncludeDeletedObjects -Properties CanonicalName,SamAccountName,ObjectSID -Credential $mycred -ErrorAction SilentlyContinue |
        Select-Object SamAccountName,ObjectSID,CanonicalName
}

In the code snippet above, $users will now contain a collection of found users with the SamAccountName,ObjectSID,CanonicalName properties for each object.

Like Get-ADUser, Get-ADObject has a limited set of default display properties. You will need to use the -Properties parameter to display what you require. You can test what is available by starting with -Properties *.

Not much information has been provided on how AD user data is being input into the script. You may have a collection of CN values or CSV file. You will have to consider how to iterate over those values.