Another point you want to just remember for your AZ‑801 exam is SID filtering,
or SID quarantine as it's sometimes called.
As you can see in the screenshot at the right here we're looking at a
particular Active Directory user account's properties.
And when you're in advanced view, you can view the underlying
schema attributes. And I want you to see, you probably already
know this, that every object, every user, specifically, is
going to have a security ID.
When you migrate a user to a new forest,
that object is going to have a new, brand‑new SID that's generated from
the domain in which the user has been migrated to.
We don't want those migrated user accounts to be susceptible to misuse,
like forging their old user SID into high privilege groups in the new domain,
so this involves what's called the SID history attributes.
So in this example at the right, the migrated user has the,
I'm just looking at the last two digits, 36 as their new migrated user SID.
But if we're honoring SID history, their previous, prior to the migration,
their user SID ended in 87, and we're maintaining that. By default,
SID quarantine, or SID filtering, is enabled; in other words, by default,
the SIDs are actually filtered out of the user attributes.
I want you to just be aware of this.
There may be edge cases where you do want to override that. You can
configure SID filtering behavior using either Windows PowerShell or
the Netdom compiled executable. It's just something that would be
specific to your use case.
Check the docs on it. The docs are definitely on the
old side with this because, again,
it's been something that's in Active Directory for a long time and really hasn't changed in the last several years.