Remapping historical SIDs after domain migration

About this task

In a domain migration scenario, a VOB database includes additional SIDs that represent the SID histories of the security principals (users and groups) who own objects in the VOB. These historical SIDs were associated with the security principals before migration and are stored in the principal’s sIDHistory attribute in an Active Directory domain.

To replace the historical SIDs stored in the VOB database with new ones that resolve to the appropriate security principals in the Active Directory domain, use a command such as this one:

vob_sidwalk –sidhistory –execute vob-tag SIDfile-path

When invoked with the –sidhistory option, vob_sidwalk uses the following algorithm to determine SID history:
  1. Look up a SID to find the account name.
  2. Look up the account name found in Step 1 to find its SID.
  3. If the SID returned in Step 2 is different from the SID used in Step 1, the SID used in Step 1 is assumed to be a historical SID, and the SID returned in Step 2 is written to the new-SID field of the current line of SIDfile-path.