Search AD object via ConsistencyGUID

July 31, 2020 | by iaur | posted as Active Directory, Azure AD

Scenario

  • Admin center is showing duplicate MSOL user and both are syncing to O365 thus, you are looking to see if you can merge it
  • You have two identical MSOL users and would like a safe way to delete one

Context

Do a ConsistencyGUID search of a specific AD object.

Firstly, you don’t have to really merge these and there’s no way to really do that. Both MSOL user are synced with AD consequently, the question is who is to retain and obviously it would be the licensed account.

That is to say, you just need to find the equivalent AD object of the unlicensed MSOL user by doing a ConsistencyGUID (mS-DS-ConsistencyGUID) search and move it away from the syncing OU. Therefore, will delete it from O365 and will no show showing in the Admin center under active user.

Steps

  • Connect to MSOL using PowerShell
  • Run below cmdlet to find the immutableID of the unlicensed user
# user@domain.onmicrosoft.com is the unlicensed user

Get-MSOLuser -UserPrincipalName user@domain.onmicrosoft.com | fl name,immutableID
Machine generated alternative text:
6 
Connect-MS01 servi ce 
-Credential Scredenti al 
Facere Sionem> Set-MSOLuser 
Facere Sionem> Get—MSOLuser 
Windows PowerShell 
Sstr. system. convert : ;From8ase64Str1ng 
S hex 
= —join astring I 
$ s ear ch 
= Shex -replace , '\$I' 
$ aduser 
= Get—AdUser —LDAPFi Iter " 
PS C: \Users\rootvm\OneDrive 
PS C: \Users\rootvm\OneDrive 
-Userprincipa1Name ron( 
-Userprincipa1Name ron( 
Immutabl eld 
JONJIOM4CU+/JM5QcikQog 
C : users \ rootvm> 
C : \ Users 
Di ngui shedNæne 
Enabl ed 
Gi venName 
Name 
b j ectCl ass 
bj ectGUID 
SamAccountName 
SID 
PS C : 
: CV=Ron pugoy , OU=0365 Users , 
: True 
. Ron 
: Ron Pugoy 
user 
: 23498326-3843-4f09-bf24-ce50722910ü 
. ron 
: s-1-5-21-1324791489-3160699361-1173794010-1105 
Pugoy 
User-principalNæne : com 
File Action View 
PS C: \Users\rootvm\OneDrive 
Facere Sionem> 
Active Directo 
Help 
Name 
Builtin 
Computers 
Users and Computers 
Type 
Description 
Bernie Ferna„. Contact 
Domain Controllers 
ForeignSecurityPrinc• 
LostAndFound 
Managed Service Ac 
0365 Users 
Program Data 
Jasun 
8. 
P,cn Pugoy 
test 
test bin 
Test222 
User 
L'ser 
Distribution Gr... 
Contact 
Organizational...
  • Take note of the immutable ID
  • Access your Local AD
  • Open PowerShell
  • Run below cmdlet that will search for the AD object that match the immutableID value
# ENTER_IMMUTABLE_ID_HERE is the ImmutableID from the previous steps

$string=[system.convert]::FromBase64String("ENTER_IMMUTABLE_ID_HERE")

$hex = -join ($string | %{$_.tostring("X").padleft(2,"0")})

$search = $hex -replace '(..)','\$1'

$adUser = Get-AdUser -LDAPFilter "(ms-ds-consistencyguid=$search)"
  • Once you’ve retrieve it, all you need to do is locate the OU where the object is after that move it to a not-synced OU
  • Finally, wait for 30 minutes to an hour for a passive sync (AAD) to complete

Screenshot:

Search AD object via ConsistencyGUID

Reference

Feedback or Help?

Should you have one, click here

Boring Ads. Pardon me :)