Security Identifier

From Wikipedia, the free encyclopedia

In the context of the Microsoft Windows NT line of operating systems, a Security Identifier (commonly abbreviated SID) is a unique name (an alphanumeric character string) which is assigned by a Windows Domain controller during the log on process that is used to identify an object, such as a user or a group of users in a network of NT/2000 systems. SIDs are not portable.

Windows grants or denies access and privileges to resources based on access control lists (ACLs), which use SIDs to uniquely identify users and their group memberships. When a user logs into a computer, an access token is generated that contains user and group SIDs and user privilege level. When a user requests access to a resource, the access token is checked by the ACL to permit or deny particular action on a particular object.

SIDs are useful for troubleshooting issues with security audits, Windows server and domain migrations.

SID has format as follows: S-1-5-12–7623811015-3361044348-030300820-1013

S - The string is a SID.

1 - The revision level.

5 - The identifier authority value.

12–7623811015-3361044348-030300820 - domain or local computer identifier

1013 – a Relative ID (RID)

Any group or user that is not created by default will have a Relative ID of 1000 or greater.

[edit] Well known SIDs

SID: S-1-5-18

Local System. A service account that is used by the operating system.

SID: S-1-5-19

NT Authority. Local Service.

SID: S-1-5-20

NT Authority. Network Service.

SID: S-1-5-21-domain-500

A user account for the system administrator. By default, it is the only user account that is given full control over the system.

SID: S-1-5-21-domain-501

Guest user account for people who do not have individual accounts. This user account does not require a password. By default, the Guest account is disabled.

SID: S-1-5-21-domain-512

Domain Admins - a global group whose members are authorized to administer the domain. By default, the Domain Admins group is a member of the Administrators group on all computers that have joined a domain, including the domain controllers. Domain Admins is the default owner of any object that is created by any member of the group.