If you have arrived at this page because of a search covering the nefarious (and cryptic) error message, “The SDDL string contains an invalid sid or a sid that cannot be translated”, then search no further. Of course, I should mention that this error, although being unique, is one that can actually occur for many different Microsoft products. However, for the intent and purpose of this post, I am referring to this exception being thrown while attempting to synchronise ADAM/AD LDS with Active Directory using ADSchemaAnalyzer.
I have been contacted about this error a few times and, it was not until the last time I was contacted, that it finally clicked for me as to why this was occurring. Here is the very quick answer for those who do not want to wait:
If you get this error while trying to sync your ADAM/AD LDS instance with Active Directory, it simply means that the host from which the sync is being initiated is not joined to the domain, thus not trusted to perform any sync activities.
Now for a bit of a longer answer. When you synchronise your ADAM/AD LDS instance with Active Directory, you are attempting to enter into a trusted relationship with AD. This is no different than walking up to someone you know and saying, “Hey, I need to copy down your emergency contact info in the event that I need to use it at a later date”. If you do not know the aforementioned person, you will not get the data because you are not trusted by/known to them. This would otherwise be known as, “Piss off, I really do not have time for this…stalker.” Ok, perhaps we should not look at ADAM/AD LDS as “stalkers”, but I think the point is made. In order to get the information you want/need, there needs to be some trust in the relationship between the two entities.
The trust that needs to take place between an ADAM/AD LDS instance and an Active Directory DC comes in the form of being domain-joined (you have set your DNS to the AD DC and, you have an identity on the DC that can perform synchronisation activities (e.g. security group membership, username/password). When you have both of these items and you attempt to synchronise your ADAM/AD LDS instance with your DC, the conversation go a little something like this:
“Hey, Win2k8R2.fnet.local, I know we have to spoken in a while, but I wanted to catch up with and see what has been going on with you. You remember, right? I joined your group approximately a year ago and have been working with your server team. I have recently been promoted and need to get some additional information from you. You need to vet and verify me? Not a problem, here is the information you need to know.” And on and on until they finally synchronise information to the ADAM/AD LDS instance.
Without this trust, the conversation would go nowhere because the ADAM/ AD LDS server is not known, therefore now trusted, by the DC.
You might be wondering, “Doug, did you not show us how to disable directory security to allow for a sync without using SSL?” Yes, I did, but that is simply allowing traffic to pass in the clear between two trusted devices; This is not recommended, but is certainly helpful when first setting up a synchronised ADAM/AD LDS instance. In addition, it is not the same because the DC does not have any reference point (SID) for the ADAM/AD LDS instance/server that is trying to perform the sync.
In the long run, this makes perfect sense simply for the fact of security and trust. I did look into the possibility of getting around this, but then considered the ramifications of getting this untrusted connection/sync to work; I would essentially be showing you how to subvert necessary safeguards that have been built into Active Directory to help preclude this type of activity from occurring. Also, the last thing I want is for one of you to come back to me and say, “Thanks for helping me do something stupid on my network…the system was compromised and now our data is in the wild”. I am not saying that a server cannot be compromised without this, but I do not want this to only add insult to injury.
So, there you have it. Finally, a reason why you are getting the error, “The SDDL string contains an invalid sid or a sid that cannot be translated”.
{ 2 comments }
