Understanding the Difference Between the GUID and objectGUID Properties in Active Roles PowerShell Cmdlets (4384068)

Administrators may observe that the GUID and objectGUID properties returned by Active Roles PowerShell cmdlets appear to contain different values for the same Active Directory object. In reality, both properties represent the same underlying object identifier, but they are returned in different formats.

The GUID property returns the object identifier in the standard GUID format used by Active Roles, Active Directory Users and Computers (ADUC), and most Microsoft tools. The objectGUID property returns the raw Active Directory octet string, which uses a different byte ordering for the first three GUID fields.

 Consider the following PowerShell cmdlet:

Active Directory stores the objectGUID attribute as a 16-byte binary value (octet string).

When a GUID is represented in its standard textual format, the first three fields are interpreted using little-endian byte ordering:

When comparing object identifiers:

• Use the GUID property when comparing values shown in:

  • Active Roles Console
  • Active Directory Users and Computers
  • ADSI Edit
  • PowerShell [GUID] objects
  • .NET applications

• Use the objectGUID property when working with:

  • Raw LDAP data
  • Binary GUID values
  • LDAP filters that require octet-string formatting
  • Low-level directory integrations

If a comparison appears to fail, convert both values to a common representation before comparing them.