title: What Active Directory field do I use to uniquely identify a user?
body: <p>I have an Asp.net MVC project authenticating through AD. I would like to store audit information in tables for the current logged in user. What should I be storing in the database? I am currently using <a href="http://msdn.microsoft.com/en-us/library/system.directoryservices.accountmanagement.principal.samaccountname.aspx" rel="noreferrer">SamAccountName</a> for my membership and role providers. Should I be using this? Should I use the more verbose and modern <a href="http://msdn.microsoft.com/en-us/library/system.directoryservices.accountmanagement.principal.userprincipalname.aspx" rel="noreferrer">UserPrincipalName</a>? What if we eventually end up using multiple domains?</p>
  
  <p>What about <a href="http://msdn.microsoft.com/en-us/library/system.directoryservices.accountmanagement.principal.guid.aspx" rel="noreferrer">Guid</a>? Guid would seem like the obvious choice but I know nothing about it. Why is it nullable? Does this value change? What is it used for?</p>
  
  <h2>Update</h2>
  
  <p>According to <a href="http://msdn.microsoft.com/en-us/library/system.directoryservices.accountmanagement.principal.samaccountname.aspx" rel="noreferrer">SID vs. GUID</a> ...</p>
  
  <blockquote>
    <p>The reason for using SIDs at all, and not GUIDs, is for backward compatibility. Windows NT uses SIDs to identify users and groups in ACLs on resources.</p>
  </blockquote>
  
  <p>SIDs will actually change if you move a user to a new domain, the GUID will remain
  constant. It looks to me like GUID is the way to go unless you intend to authenticate against a NT4 AD server.</p>
  
  <p>I'm not sure what to do here as I cannot accept my own answer for 2 days. Most in-depth explanation wins?</p>