resolve ForeignSecurityPrincipals to distinguishedName in PowerShell - powershell

Question

I have a ForeignSecurityPrincipals and need to resolve it to the distinguishedName but am not sure how.
I have this code to get the NTAccount:
$m = "CN=S-1-1-11-1111111111-1111111111-1111111111-1111111,CN=ForeignSecurityPrincipals,DC=one,DC=two,DC=company,DC=com"
$member = [ADSI]("LDAP://" + $m)
$sid = New-Object System.Security.Principal.SecurityIdentifier ($member.objectSid[0], 0)
$sid.Translate([System.Security.Principal.NTAccount]).value

Answer 1

You can bind to an object using the SID (and then get the distinguishedName), but you have to know at least the DNS name of the domain:
$user = [ADSI]"LDAP://$domaindns/<SID=$($sid.Value)>"
To get the DNS name of the domain, you need to examine all the trusts your domain has and store the DNS name and the SID of the domain in a list. Then you can match the domain portion of the user's SID with your list and get the DNS name (a user's SID will start with the domain's SID).
This page has some info on pulling all of the trusts, but the method he ends up using is WMI, which may not work, depending on your permissions. It didn't for me. You can do the same with ADSI, but I haven't done it. It's a starting point at least.
Update:
You can try this:
$DomainSIDList = #{}
$Forest = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()
#Get trusts from each domain in the forest -- this will include forest trusts
ForEach($Domain in $Forest.Domains) {
$adsisearcher = New-Object system.directoryservices.directorysearcher
$adsisearcher.SearchRoot = [ADSI]"LDAP://CN=System,$($Domain.GetDirectoryEntry().distinguishedName)"
$adsisearcher.Filter = "(objectclass=trustedDomain)"
ForEach($ExtDomain in $adsisearcher.FindAll()) {
$name = $ExtDomain.Properties["name"][0]
"Found $($name)"
$sid = New-Object System.Security.Principal.SecurityIdentifier ($ExtDomain.Properties["securityidentifier"][0], 0)
if (-not $DomainSIDList.Contains($sid.Value)) {
"Adding $($sid.Value), $($name)"
$DomainSIDList.Add($sid.Value, $name)
}
}
}
Once that runs, $DomainSIDList will contain a list of trusted domains. It'll contain all the domains in the forest, which you don't really need, but that's not a big deal.