Security Identifier

Short description: Identifier used for user accounts and groups in Microsoft Windows

Security Identifier (SID) is a unique, immutable identifier of a user account, user group, or other security principal in the Windows NT family of operating systems. A security principal has a single SID for life (in a given Windows domain), and all properties of the principal, including its name, are associated with the SID. This design allows a principal to be renamed (for example, from "Jane Smith" to "Jane Jones") without affecting the security attributes of objects that refer to the principal.

## Contents

* 1 Overview
* 2 Structure
* 2.1 Identifier authority
* 2.2 Subauthority
* 3 Domain SIDs
* 3.1 Machine SIDs
* 4 Service SIDs
* 5 Duplicated SIDs
* 6 See also
* 7 Footnotes
* 8 References
* 9 External links

## Overview

Windows grants privileges and access to resources based on access control lists (ACLs). Each entry on the list defines one SID and a set of permissions for that SID. When a user logs into a PC, Windows generates an access token that contains the user SID, the group SIDs to which the user account belongs, and the user privilege level. When a user requests access to a resource, its ACL is checked against the user's access token to permit or deny particular action on a particular object.

## Structure

The human-readable representation of a SID is a string that starts with "S-" and consists of several dash-separated numbers. For example, "S-1-5-21-3623811015-3361044348-30300820-1013" could be a user account's SID. The following table explains the components of this example SID.

Anatomy of a SID  Component  | Example  | Explanation

|
|

Header  | S  | Identifies the string as a SID
Revision level  | 1  | The version number of the SID specification. As of 2025[update], "1" is the only valid number.
Authority  | 5  | See below
Subauthorities  | 21-3623811015-3361044348-30300820  | In this example, "21" indicates a "domain" subauthority. The following 96-bit ID is a domain identifier.
Relative ID (RID)  | 1013  | Uniquely identifies the principal within its subauthority group. In the context of domain accounts (which is the focus of our example), RIDs greater than 1000 indicate an admin-defined principal (as opposed to a predefined, built-in, or special-purpose generic principal).

Originally, SIDs were supposed to allow arbitrarily deep nesting, with each level allowed to create sub-authorities underneath itself. However, that goal was abandoned early in Windows NT development, when it was decided that it would be too unmanageable in practice; by then, however, the SID format had already been finalized and was in heavy use in the Windows code.[1]

### Identifier authority

Identifier authorities are formally defined as six-byte (48-bit) quantities. The identifier authority is expressed in decimal if its value is less than 232, otherwise in hexadecimal.[2][3] However, while this is the behavior formally defined by Microsoft, and implemented by the relevant Windows APIs (e.g. `RtlConvertSidToUnicodeString`),[3] hexadecimal identifier authorities appear to have never been used in practice. All known values fit in the least significant byte, and the other 5 bytes are always zero. Identifier authorities are stored in big-endian format, even on little-endian CPU architectures.

Valid identifier authority values[4][5] Authority  | Formal name  | First introduced  | Notes

|
|
|

0  | Null Authority  |  | e.g., "Nobody" (S-1-0-0)
1  | World Authority  |  | e.g., well-known groups such as "Everyone". (S-1-1-0)
2  | Local Authority  |  | e.g., flag SIDs like "CONSOLE LOGON"
3  | Creator Authority  |  |
4  | Non-unique Authority  |  |
5  | NT Authority  |  | Managed by the NT security subsystem. There are many sub-authorities such as "BUILTIN" and every Active Directory Domain
6[6][7] | Site Server Authority  | Windows XP |
7[6][7] | Internet Site Authority  | Windows XP |
8[6][7][8] | Exchange Authority  | Windows XP |
9[7][9][10] | Resource Manager Authority  | Windows Server 2003 |
10[6] | Passport Authority  |  |
11[11] | Microsoft Account Authority  | Windows 8 |
12  | Azure Active Directory  | Windows 10 |
15[12][13][14] | App Package Authority (Capability SIDs)  | Windows Server 2012 | All capability SIDs begin at S-1-15-3. By design, a capability SID does not resolve to a friendly name. The most commonly used capability SID is S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681
16[15] | Mandatory Label Authority  | Windows Vista | Used as part of Mandatory Integrity Control
17[16] | Scoped Policy ID Authority  |  |
18[16] | Authentication Authority  |  |
19[17] | Process Trust Authority  |

### Subauthority

S-1-5 subauthority values[12][18][5] Decimal  | Name  | First introduced  | Format and purpose

|
|
|

1  | Dial-up Login  |  | `S-1-5-1`.
2  | Network Login  |  | `S-1-5-2`.
3  | Batch Login  |  | `S-1-5-3`.
4  | Interactive Login  |  | `S-1-5-4`.
6  | Service Login  |  | `S-1-5-6`.
7  | Anonymous Login  |  | `S-1-5-7`.
8[5] | Proxy Login  | Windows Server 2003 | `S-1-5-8` is the SID of the "SECURITY_NT_AUTHORITY" proxy.[5]
9  | Enterprise Domain Controllers  |  | `S-1-5-9`.
10  | Principal Self  |  | `S-1-5-10`.
11  | Authenticated Users  | Windows NT 4.0 | `S-1-5-11`.
12  | Restricted Code  | Windows 2000 | `S-1-5-12`.
13  | Terminal Server User  |  | `S-1-5-13`.
14  | Remote Interactive Login  |  | `S-1-5-14`.
15  | This Organisation  |  | `S-1-5-15`.
17  | IUSR  |  | `S-1-5-17`.
18  | LocalSystem  | Windows NT 3.1 | `S-1-5-18` is the SID of the LocalSystem account on all Windows machines.
19  | LocalService  | Windows XP | `S-1-5-19` is the SID of the LocalService account on all Windows machines.
20  | NetworkService  | Windows XP | `S-1-5-20` is the SID of the NetworkService account on all Windows machines.
21  | Domain  | Windows NT 3.1 | `S-1-5-21-<Domain ID>-<RID>`, where `<Domain ID>` is in the form of `<32-bit>-<32-bit>-<32-bit>`. See below for details.
32  | Builtin  | Windows NT 3.1 | `S-1-5-32-<RID>`. Example: S-1-5-32-544 (the built-in Administrators group).

The resulting SID pertains a predefined, special-purpose user group, and is valid on all Windows machines. RID could only be one the predefined ones.

33  | Write Restricted Code  | Windows 7 | `S-1-5-33`.
64  | Authentication  |  | `S-1-5-64-<RID>`, where `<RID>` is one of the following:

* 10: NTLM
* 14: SChannel
* 21: Digest

80  | NT Service  | Windows Vista | `S-1-5-80-<RID>`, where `<RID>` is a service identifier. "0" (zero) is reserved for the ALL SERVICES group (hence, S-1-5-80-0's fully qualified name is NT SERVICE\ALL SERVICES).
82  | IIS AppPool  | Windows 7 |
83-0  | Virtual Machines  | Windows 7 | `S-1-5-83-0` is the SID of the "NT VIRTUAL MACHINE\Virtual Machines" group, which maintains a list of all Hyper-V virtual machines.
83-1  | Virtual Machine  | Windows 7 | `S-1-5-83-1-<ID1>-<ID2>-<ID3>-<ID4>`.

The resulting SID pertains a Hyper-V virtual machine.

90[5] | Windows Manager  | Windows 7 | `S-1-5-90-0` is the SID of the "Windows Manager Group", a built-in group that maintains all virtual accounts of the Desktop Windows Manager (DWM).

`S-1-5-90-0-<RID>`, where `<RID>` is a number, is the SID format of a DWM virtual account. For example, `S-1-5-90-0-1` pertains DWM-1.

96  | User-Mode Driver Framework  | Windows 7 | `S-1-5-96-0-<RID>`, where `<RID>` is a number, is the SID format of a User-Mode Driver Framework (UMDF) virtual account. For example, `S-1-5-96-0-1` pertains UMDF-1. The User-mode Font Driver Host (`fontdrvhost.exe`) runs in the context of a UMDF account.
113  | Local Account  |  | `S-1-5-113`.
114  | Local Account & Administrator  |  | `S-1-5-114`.
1000  | Other Organisation  |  | `S-1-5-1000`.

## Domain SIDs

SIDs that start with "S-1-5-21" are noticeably longer than most other SIDs (with the notable exception of service SIDs). Their general format is: `S-1-5-21-<Domain ID>-<RID>`, where `<Domain ID>` is in the form of `<32-bit>-<32-bit>-<32-bit>`.

The Domain ID uniquely identifies a Windows domain. The RID specifies a principal (user account, group account, or computer account) within that domain.

If the RID portion is greater than 1000, the resulting SID pertains an admin-defined user account, user group, or computer account, e.g., S-1-5-21-3361044348-303008203623811015-1001. The name of this account could be anything, e.g., `Domain.local\JaneDoe`.

If the RID portion is smaller than 1000, the resulting SID pertains a predefined (built-in) user account or user group. For example, RID 500 identifies the controversial "Administrator" user account while RID 512 pertains the "Domain Admins" group.

### Machine SIDs

Machine SIDs are variety of domain SIDs (S-1-5-21) with a 96-bit domain ID (a machine is considered its own local domain) but no RID. Their general format is: `S-1-5-21-<Machine ID>`, where `<Machine ID>` is in the form of `<32-bit>-<32-bit>-<32-bit>`.

The machine SID is stored in the SECURITY hive of the Windows Registry, more specifically at `HKEY_LOCAL_MACHINE\SECURITY\SAM\Domains\Account`. This key has two values: F and V. The latter is a raw binary value that has the machine SID embedded within it at the end of its data (last 96 bits).[19] (Some sources(Also see January 2025). state that it is stored in the SAM hive instead.)

> NewSID ensures that this SID is in a standard NT 4.0 format (3 32-bit subauthorities preceded by three 32-bit authority fields). Next, NewSID generates a new random SID for the computer. NewSID's generation takes great pains to create a truly random 96-bit value, which replaces the 96-bits of the 3 subauthority values that make up a computer SID.

— NewSID readme[20]

The machine SID is stored in a raw-bytes form in the registry. To convert it into the more common numeric form, one interprets it as three, little endian, 32-bit integers, converts them to decimal, and add hyphens between them.

Example of decoding machine SID  Raw form (hexadecimal representation)  | `2E,43,AC,40,C0,85,38,5D,07,E5,3B,2B`

|

Split the bytes into 3 groups of four octets  | `2E,43,AC,40 - C0,85,38,5D - 07,E5,3B,2B`
Reverse the order of bytes in each group  | `40,AC,43,2E - 5D,38,85,C0 - 2B,3B,E5,07`
Convert each group into decimal  | `1085031214 - 1563985344 - 725345543`
Add the machine SID prefix  | `S-1-5-21-1085031214-1563985344-725345543`

## Service SIDs

Service SIDs are a feature of service isolation, introduced in Windows Vista and Windows Server 2008.[21] Any service with the "unrestricted" SID-type property will have a service-specific SID added to the access token of the service host process, allowing permissions for a single service to be managed without necessitating the creation of service accounts.

Each service SID is a local, machine-level SID that has the general form of `S-1-5-80-<Service ID>`. To generate `<Service ID>`, Windows copies the service name (in UTF-16 encoding), converts all characters to uppercase, and calculates the SHA-1 digest of said uppercase name. This digest becomes the `<Service ID>`. The `sc.exe` command can be used to generate this special SID value; for example, given the "dnscache" service:

C:\>sc query

NAME: dnscache
SERVICE SID: S-1-5-80-859482183-879914841-863379149-1145462774-2388618682

Therefore, the "dnscache" service can be referred to as either `NT SERVICE\dnscache` or `S-1-5-80-859482183-879914841-863379149-1145462774-2388618682`. Since a Service SID is determined exclusively by the service name, the value of the SID for a given service is always the same across all machines wherever the service runs.

## Duplicated SIDs

A common method of mass-producing Windows PCs is to install Windows on a template machine, and duplicate its disk sector by sector to other identical machines. As a result, these mass-produced machines are identical in every respect, including their SIDs.[20]

Microsoft engineer Mark Russinovich is the creator of a utility called NewSID, the purpose of which is to solve "The SID Duplication Problem."[20] Microsoft has retired the utility on November 2, 2009, because, Mark and the Windows security team have concluded that duplicate SIDs do not pose any problem whatsoever.[22]

## See also

* Access control
* Access Control Matrix
* Discretionary Access Control (DAC)
* Globally Unique Identifier (GUID)
* Mandatory Access Control (MAC)
* Role-Based Access Control (RBAC)
* Capability-based security
* Post-cloning operations

## Footnotes

## References

1. ↑ "[MS-AZOD: Security Identifiers (SIDs)"]. 2022-06-14. https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-azod/ecc7dfba-77e1-4e03-ab99-114b349c7164.
2. ↑ "[MS-DTYP: SID String Format Syntax"] (in en-us). 2023-12-12. https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/c92a27b1-c772-4fa7-a432-15df5f1b66a1.
3. ↑ 3.0 3.1 "RtlConvertSidToUnicodeString function (ntifs.h) - Windows drivers" (in en-us). 2022-11-04. https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-rtlconvertsidtounicodestring.
4. ↑ "Well-known security identifiers in Windows operating systems". https://support.microsoft.com/en-hk/help/243330/well-known-security-identifiers-in-windows-operating-systems. Retrieved 12 December 2019.
5. ↑ 5.0 5.1 5.2 5.3 5.4 openspecs-office. "[MS-DTYP: Well-Known SID Structures"] (in en-us). https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab.
6. ↑ 6.0 6.1 6.2 6.3 "[MS-PAC: SID Filtering and Claims Transformation"] (in en-us). 2023-06-28. https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pac/55fc19f2-55ba-4251-8a6a-103dd7c66280.
7. ↑ 7.0 7.1 7.2 7.3 Honeycutt, Jerry (2005) (in en). Microsoft Windows Registry Guide. Microsoft Press. pp. 11. ISBN 978-0-7356-2218-0. https://books.google.com/books?id=y4pGAAAAYAAJ&pg=PA11.
8. ↑ "Outlook2007CodeSamples/SampleWrappedPSTStoreProvider/WrapPST/EdkMdb.h at 10edfa1ce7e6895a4788ad7c766b9120bec0128d · microsoft/Outlook2007CodeSamples" (in en). https://github.com/microsoft/Outlook2007CodeSamples/blob/10edfa1ce7e6895a4788ad7c766b9120bec0128d/SampleWrappedPSTStoreProvider/WrapPST/EdkMdb.h#L1183.
9. ↑ See "Custom Principals" section on https://msdn.microsoft.com/en-us/library/aa480244.aspx
10. ↑ "Larry Osterman's WebLog". 17 July 2020. http://blogs.msdn.com/larryosterman/archive/2004/09/01/224051.aspx.
11. ↑ "Example impact of Microsoft Accounts on Windows APIs in Windows 8/8.1 – Windows SDK Support Team Blog". 12 December 2014. https://blogs.msdn.microsoft.com/winsdk/2014/12/12/example-impact-of-microsoft-accounts-on-windows-apis-in-windows-88-1/.
12. ↑ 12.0 12.1 "Security identifiers". 28 August 2021. https://support.microsoft.com/en-us/help/243330/well-known-security-identifiers-in-windows-operating-systems.
13. ↑ "Some SIDs do not resolve into friendly names". 24 September 2021. https://support.microsoft.com/en-us/help/4502539/some-sids-do-not-resolve-into-friendly-names.
14. ↑ "Capability SID Constants (Winnt.h) - Win32 apps" (in en-us). https://docs.microsoft.com/en-us/windows/win32/secauthz/capability-sid-constants.
15. ↑ "SYSTEM_MANDATORY_LABEL_ACE (winnt.h) - Win32 apps" (in en-us). 2024-02-22. https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-system_mandatory_label_ace.
16. ↑ 16.0 16.1 "[MS-DTYP: SID_IDENTIFIER_AUTHORITY"] (in en-us). 2020-10-30. https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/c6ce4275-3d90-4890-ab3a-514745e4637e.
17. ↑ "Sandboxing Antimalware Products for Fun and Profit — Elastic Security Labs" (in en). 2023-02-21. https://www.elastic.co/security-labs/sandboxing-antimalware-products.
18. ↑ "IIS AppPool Identity SIDs". 2020-09-02. https://winterdom.com/2014/05/16/iis-apppool-identity-sids.
19. ↑ "MS TechNet NewSID Utility - How It Works". Knowledge Base. Microsoft. November 1, 2006. https://technet.microsoft.com/en-us/sysinternals/bb897418.aspx. Retrieved 2008-08-05.
20. ↑ 20.0 20.1 20.2 "NewSID v4.10". Windows Sysinternals. Microsoft. 2006-11-01. https://learn.microsoft.com/en-us/sysinternals/downloads/newsid.
21. ↑ "Windows Service Isolation Feature". Article. Windows IT Pro. June 6, 2012. http://www.windowsitpro.com/article/authentication/windows-service-isolation-143215. Retrieved December 7, 2012.
22. ↑ Russinovich, Mark (2009-11-03). "The Machine SID Duplication Myth". Mark's Blog. Microsoft. https://learn.microsoft.com/en-us/archive/blogs/markrussinovich/the-machine-sid-duplication-myth-and-why-sysprep-matters.

## External links

* Official
* ObjectSID and Active Directory
* Microsoft TechNet: Server 2003: Security Identifiers Technical Reference
* MSKB154599: How to Associate a Username with a Security Identifier
* MSKB243330: Well-known security identifiers in Windows operating systems
* Support tools for Windows Server 2003 and Windows XP
* Security Identifiers - Windows Security docs
* Other
* Why Understanding SIDs is Important
* Microsoft Security Descriptor (SID) Attributes : Tutorial Article about SID handling / converting in scripts

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/Security Identifier. Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Security_Identifier&oldid=4228481"