What is a SID (Security ID)?

A. SID stands for Security Identifier and is used within NT/2000 as avalue to uniquely identify an object such as a user or a group. The SID assignedto a user becomes part of the access token, which is then attached to any actionattempted or process executed by that user or group. If a duplicate SID didexist then all users with this SID would authenticate as what would be seen asthe same user. It is possible for cloned machines to have the same SID, whichwould be seen by the authentication mechanism as the same machine. The SID undernormal operation will be unique and will identify an individual object such as auser, group or a machine.

A SID contains:

For example: S-1-5-21-917267712-1342860078-1792151419-500

Below is a list of the values for SIDs on a default NT 4 installation;

Notice the unique value 500 for Administrator and 501 for Guest.

- Built-In Users

DOMAINNAMEADMINISTRATOR

S-1-5-21-917267712-1342860078-1792151419-500 (=0x1F4)

DOMAINNAMEGUEST

S-1-5-21-917267712-1342860078-1792151419-501 (=0x1F5)

- Built-In Global Groups

DOMAINNAMEDOMAIN ADMINS

S-1-5-21-917267712-1342860078-1792151419-512 (=0x200)

DOMAINNAMEDOMAIN USERS

S-1-5-21-917267712-1342860078-1792151419-513 (=0x201)

DOMAINNAMEDOMAIN GUESTS

S-1-5-21-917267712-1342860078-1792151419-514 (=0x202)

- Built-In Local Groups

BUILTINADMINISTRATORS S-1-5-32-544 (=0x220)

BUILTINUSERS S-1-5-32-545 (=0x221)

BUILTINGUESTS S-1-5-32-546 (=0x222)

BUILTINACCOUNT OPERATORS S-1-5-32-548 (=0x224)

BUILTINSERVER OPERATORS S-1-5-32-549 (=0x225)

BUILTINPRINT OPERATORS S-1-5-32-550 (=0x226)

BUILTINBACKUP OPERATORS S-1-5-32-551 (=0x227)

BUILTINREPLICATOR S-1-5-32-552 (=0x228)

- Special Groups

CREATOR OWNER S-1-3-0

EVERYONE S-1-1-0

NT AUTHORITYNETWORK S-1-5-2

NT AUTHORITYINTERACTIVE S-1-5-4

NT AUTHORITYSYSTEM S-1-5-18

NT AUTHORITYauthenticated users S-1-5-11 *

* For Windows NT 4.0 Service Pack 3 and later only

These values can be displayed by using the utility Getsid.exe from theWindows NT Resource Kit.

C:>getsid \MACHINE ACCOUNT \MACHINE ACCOUNT

The SID for account MACHINE ACCOUNT matches account MACHINE ACCOUNT

The SID for account MACHINE ACCOUNT is

S-1-5-21-1271857391-537538043-240200450-4294967295

The SID for account MACHINE ACCOUNT is

S-1-5-21-1271857391-537538043-240200450-4294967295

For more information, see Q. How can I tell which User has which SID? and Q. What are the problems with workstations having the same SID?

For more other information, see

http://support.microsoft.com/support/kb/articles/Q163/8/46.asp

For information on extracting the SID from an ACE see

http://support.microsoft.com/support/kb/articles/q102/1/01.asp

For information on how to associate a Username with a Security Identifier(SID) see

http://support.microsoft.com/support/kb/articles/Q154/5/99.asp

Contributed by Nathan House