How can I find a username associated with a memberSID in Sentinel?

0
14
Asked By SunnySky829 On

I received an alert saying "user account added to built in domain local or global group." The raw logs show a memberSID, but the member name is blank. I've opened a ticket for assistance, and now the POC wants me to identify the username linked to that memberSID. I'm not sure how to do this—any guidance would be really appreciated!

2 Answers

Answered By TechSavvy99 On

This seems more related to Active Directory than Azure! You can use PowerShell to find the username from the memberSID. Check out commands like Get-ADUser to pull the details you need. Just make sure you have the right permissions to run these queries.

Answered By CuriousCoder73 On

If you're uncertain about where to start with searching for the username, you might want to try Google for PowerShell cmdlets that deal with SID lookups. It really helps to focus on the Active Directory context instead of Azure.

Related Questions

LEAVE A REPLY

Please enter your comment!
Please enter your name here

This site uses Akismet to reduce spam. Learn how your comment data is processed.