How can I change the SID of a user account in the Active Directory?

Solution 1:

You can't. You have to do an authoritative restore of the user account in order to get a user back. Have a look at this Technet article.

Solution 2:

I know this question has been answered, but for the future you may also look at the tools out there like Quest's Recovery Manager for Active Directory. If you have a system state backup it can recover the object without a reboot of the DC. They've been known to work with folks in a situation like yours to try and get you up and running in hopes of getting a sale. Better, though, is to already have it licensed and in place in case there's a major issue, like someone deleting an OU or something drastic like that.

Solution 3:

The answer I'm afraid is "you don't". A good writeup of what SIDs are, what they're used for and how they work is here: http://technet.microsoft.com/en-us/library/cc961998.aspx which should make the reasons why obvious.

Update for 2017

The Active Directory Recycle Bin has been a feature since Windows Server 2008 R2. It's designed for just the scenario in the OP (recovering accidentally deleted objects - "Active Directory Recycle Bin helps minimize directory service downtime by enhancing your ability to preserve and restore accidentally deleted Active Directory objects without restoring Active Directory data from backups, restarting Active Directory Domain Services (AD DS), or rebooting domain controllers."), removes the need for third-party software (which doesn't always interoperate cleanly, and is not always robust in the face of OS updates), incurs minimal overhead, and has saved my own ass a number of times. Highly recommended.