Security Identifier

Windows grants privileges and access to resources based on access control lists (ACLs). Each entry on the list defines one SID and a set of permissions for that SID. When a user logs into a PC, Windows generates an access token that contains the user SID, the group SIDs to which the user account belongs, and the user privilege level. When a user requests access to a resource, its ACL is checked against the user's access token to permit or deny particular action on a particular object.

The human-readable representation of a SID is a string that starts with "S-" and consists of several dash-separated numbers. For example, "S-1-5-21-3623811015-3361044348-30300820-1013" could be a user account's SID. The following table explains the components of this example SID.

Originally, SIDs were supposed to allow arbitrarily deep nesting, with each level allowed to create sub-authorities underneath itself. However, that goal was abandoned early in Windows NT development, when it was decided that it would be too unmanageable in practice; by then, however, the SID format had already been finalized and was in heavy use in the Windows code.{{Cite web |date=2022-06-14 |title=[MS-AZOD]: Security Identifiers (SIDs) |url=https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-azod/ecc7dfba-77e1-4e03-ab99-114b349c7164 |access-date=2024-12-29 |website=learn.microsoft.com}}

Identifier authorities are formally defined as six-byte (48-bit) quantities. The identifier authority is expressed in decimal if its value is less than 2³², otherwise in hexadecimal.{{Cite web |date=2023-12-12 |title=[MS-DTYP]: SID String Format Syntax |url=https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/c92a27b1-c772-4fa7-a432-15df5f1b66a1 |access-date=2024-12-29 |website=learn.microsoft.com |language=en-us}}{{Cite web |date=2022-11-04 |title=RtlConvertSidToUnicodeString function (ntifs.h) - Windows drivers |url=https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-rtlconvertsidtounicodestring |access-date=2024-12-29 |website=learn.microsoft.com |language=en-us}} However, while this is the behavior formally defined by Microsoft, and implemented by the relevant Windows APIs (e.g. RtlConvertSidToUnicodeString), hexadecimal identifier authorities appear to have never been used in practice. All known values fit in the least significant byte, and the other 5 bytes are always zero. Identifier authorities are stored in big-endian format, even on little-endian CPU architectures.

SIDs that start with "S-1-5-21" are noticeably longer than most other SIDs (with the notable exception of service SIDs). Their general format is: S-1-5-21--, where is in the form of <32-bit>-<32-bit>-<32-bit>.

The Domain ID uniquely identifies a Windows domain. The RID specifies a principal (user account, group account, or computer account) within that domain.

If the RID portion is greater than 1000, the resulting SID pertains an admin-defined user account, user group, or computer account, e.g., S-1-5-21-3361044348-303008203623811015-1001. The name of this account could be anything, e.g., Domain.local\JaneDoe.

If the RID portion is smaller than 1000, the resulting SID pertains a predefined (built-in) user account or user group. For example, RID 500 identifies the controversial "Administrator" user account while RID 512 pertains the "Domain Admins" group.

Machine SIDs are variety of domain SIDs (S-1-5-21) with a 96-bit domain ID (a machine is considered its own local domain) but no RID. Their general format is: S-1-5-21-, where is in the form of <32-bit>-<32-bit>-<32-bit>.

The machine SID is stored in the SECURITY hive of the Windows Registry, more specifically at HKEY_LOCAL_MACHINE\SECURITY\SAM\Domains\Account. This key has two values: F and V. The latter is a raw binary value that has the machine SID embedded within it at the end of its data (last 96 bits).{{cite web|url=https://technet.microsoft.com/en-us/sysinternals/bb897418.aspx|title=MS TechNet NewSID Utility - How It Works|work=Knowledge Base|publisher=Microsoft|date=November 1, 2006|accessdate=2008-08-05}} (Some sources{{such as|date=January 2025}} state that it is stored in the SAM hive instead.) {{citation needed span|date=January 2025|A backup is located at SECURITY\Policy\PolAcDmS\@.}}

{{Blockquote

|text=NewSID ensures that this SID is in a standard NT 4.0 format (3 32-bit subauthorities preceded by three 32-bit authority fields). Next, NewSID generates a new random SID for the computer. NewSID's generation takes great pains to create a truly random 96-bit value, which replaces the 96-bits of the 3 subauthority values that make up a computer SID.

|title=NewSID readme

}}

The machine SID is stored in a raw-bytes form in the registry. To convert it into the more common numeric form, one interprets it as three, little endian, 32-bit integers, converts them to decimal, and add hyphens between them.

{{static row numbers}}

Service SIDs are a feature of service isolation, introduced in Windows Vista and Windows Server 2008.{{cite web

|url=http://www.windowsitpro.com/article/authentication/windows-service-isolation-143215

|title=Windows Service Isolation Feature

|work=Article

|publisher=Windows IT Pro

|date=June 6, 2012

|accessdate=December 7, 2012

}} Any service with the "unrestricted" SID-type property will have a service-specific SID added to the access token of the service host process, allowing permissions for a single service to be managed without necessitating the creation of service accounts.

Each service SID is a local, machine-level SID that has the general form of S-1-5-80-. To generate , Windows copies the service name (in UTF-16 encoding), converts all characters to uppercase, and calculates the SHA-1 digest of said uppercase name. This digest becomes the . The sc.exe command can be used to generate this special SID value; for example, given the "dnscache" service:

C:\>sc query

NAME: dnscache

SERVICE SID: S-1-5-80-859482183-879914841-863379149-1145462774-2388618682

Therefore, the "dnscache" service can be referred to as either NT SERVICE\dnscache or S-1-5-80-859482183-879914841-863379149-1145462774-2388618682. Since a Service SID is determined exclusively by the service name, the value of the SID for a given service is always the same across all machines wherever the service runs.

A common method of mass-producing Windows PCs is to install Windows on a template machine, and duplicate its disk sector by sector to other identical machines. As a result, these mass-produced machines are identical in every respect, including their SIDs.

Microsoft engineer Mark Russinovich is the creator of a utility called NewSID, the purpose of which is to solve "The SID Duplication Problem."{{cite web | url = https://learn.microsoft.com/en-us/sysinternals/downloads/newsid | title = NewSID v4.10 | work = Windows Sysinternals | date = 2006-11-01 | publisher = Microsoft}} Microsoft has retired the utility on November 2, 2009, because, Mark and the Windows security team have concluded that duplicate SIDs do not pose any problem whatsoever.{{cite web | url = https://learn.microsoft.com/en-us/archive/blogs/markrussinovich/the-machine-sid-duplication-myth-and-why-sysprep-matters | title = The Machine SID Duplication Myth | first = Mark | last = Russinovich | authorlink = Mark Russinovich | date = 2009-11-03| publisher = Microsoft | work = Mark's Blog |via=Microsoft Learn's blog archive}}

• Access control
• Access Control Matrix
• Discretionary Access Control (DAC)
• Globally Unique Identifier (GUID)
• Mandatory Access Control (MAC)
• Role-Based Access Control (RBAC)
• Capability-based security
• Post-cloning operations

{{Notelist}}

{{reflist}}

• Official
• [http://portal.sivarajan.com/2011/09/objectsid-and-active-directory.html ObjectSID and Active Directory]
• [https://technet.microsoft.com/en-us/library/cc782090.aspx Microsoft TechNet: Server 2003: Security Identifiers Technical Reference]
• [http://support.microsoft.com/kb/154599 MSKB154599: How to Associate a Username with a Security Identifier]
• [http://support.microsoft.com/kb/243330 MSKB243330: Well-known security identifiers in Windows operating systems]
• [http://www.microsoft.com/downloads/details.aspx?familyid=6EC50B78-8BE1-4E81-B3BE-4E7AC4F0912D&displaylang=en Support tools for Windows Server 2003 and Windows XP]
• [https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/security-identifiers Security Identifiers - Windows Security docs]
• Other
• [http://servermigrator.blogspot.com/2006/02/why-understanding-sids-is-important.html Why Understanding SIDs is Important]
• [http://www.selfadsi.org/deep-inside/microsoft-sid-attributes.htm Microsoft Security Descriptor (SID) Attributes : Tutorial Article about SID handling / converting in scripts]

{{Authority control}}

Category:Identifiers

Category:Microsoft Windows security technology

Category:Unique identifiers

Category:Windows NT architecture