SID Help? Change domain account logon name?

[MrMMills]

OK an employee got married and I have to change the user logon as well as email and other items. Email I can handle, Dispaly Names I can handle. But how do you change a domain account logon name? I was able to get the user SID from the User2SID a tool at

http://www.jsiinc.com/SUBB/tip0500/rh0519.htm

The following MS article states you can change the following items but doesnt mention the account logon name.

http://www.microsoft.com/technet/prodtechnol/windows2000serv/deploy/confeat/09w2kadb.mspx

• Display Name Change the user account's Display Name in Active Directory Users And Computers.

• User Profile Path Change the Profile Path in Active Directory Users And Computers, and then rename the corresponding directory on disk.

• Logon Script Name If you use individual logon scripts for each user, change the Logon Script Name in Active Directory Users And Computers, and then rename the logon script on disk.

• Home Directory Change the home directory path in Active Directory Users And Computers, and then rename the corresponding directory on disk.


If I create a new user(with married name), can I apply the old user domain SID to the new user domain account? *****For the life of me today I can't find a tool to change a users SID.**** Help Please!

 

[buddafish]

just change the obvious fields in aduc and the user logon name. the underlying sid is just that, underlying. perms will follow the user object. the display names are just for us humans to relate to.

 

[MrMMills]

OK - I thought it was more intensive than that. We are about to do a Win2k to Win2K3 migration so I want to make sure the users account is perfect in AD. That brings me to the ADSIEdit tool. Any benefit of changing the users CN to the new name from the old name? Any problems in doing that?

 

[buddafish]

adsiedit is a great tool when you need it, but for what you are doing, just change the attributes on the original account and ad will replicate the changes and update it's attributes. give ad some time to work after the changes and if you want, check out the user's attributes with adsiedit. the CN should = the new user name associated with the original account. per your question: i would change nothing with adsiedit. ad is pretty solid and usually does what it is supposed to. (unless you are migrating to exchange 2k, then that is another story...)

 

[MrMMills]

Unless you migrate to Exchange 2000" ****

you hit the nail on the head. I am supposed to migrate to Exchange 2003 very soon(next month). So tell me more about ADSI in conjunction with Exchnage 2003

 

[buddafish]

i got to spend lots of time with adsiedit during our migration from exch 5.5 to 2k. killmail.exe and 5.5 exchman /raw too... just be certain that your ad is 100% correct and dns is 100% correct and yes, wins too, prior to migration from 5.5 to exch 2k. there is lots of white papers available on the migration. if you have manually entered any email addresses in ad (cause you thought you were doing yourself a service), remove them prior to building your adc. visit the exchange forums for more faq's... good luck