Security Identifier

In the context of the Microsoft Windows NT line of operating systems, a Security Identifier (commonly abbreviated SID) is a unique, immutable identifier of a user, user group, or other security principle. A security principle has a single SID for life, and all properties of the principle, including its name, are associated with the SID. This design allows a principal to be renamed (for example, from "John" to "Jane", without affecting the security attributes of objects that refer to the principal.

Overview

Windows grants or denies access and privileges to resources based on access control lists (ACLs), which use SIDs to uniquely identify users and their group memberships. When a user logs into a computer, an access token is generated that contains user and group SIDs and user privilege level. When a user requests access to a resource, the access token is checked against the ACL to permit or deny particular action on a particular object.

SIDs are useful for troubleshooting issues with security audits, Windows server and domain migrations.

The format of an SID can be illustrated using the following example: "S-1-5-21-3623811015-3361044348-30300820-1013";

S	1	5	21-3623811015-3361044348-30300820	1013
The string is a SID.	The revision level (the version of the SID specification).	The identifier authority value.	domain or local computer identifier	a Relative ID (RID). Any group or user that is not created by default will have a Relative ID of 1000 or greater.

Possible identifier authority values are:

• 0 - Null Authority
• 1 - World Authority
• 2 - Local Authority
• 3 - Creator Authority
• 4 - Non-unique Authority
• 5 - NT Authority
• 9 - Resource Manager Authority

Well-known security identifiers

A number of "well-known" security identifiers are defined by the operating system so as to ensure that specific system accounts can always be found. Microsoft maintains a complete list of these identifiers in a knowledge base article.

SID	Description
S-1-1-0	Everyone.
S-1-5-14	Remote Interactive Logon.
S-1-5-18	Local System, a service account that is used by the operating system.
S-1-5-19	NT Authority, Local Service
S-1-5-20	NT Authority, Network Service
S-1-5-29	Network Service
S-1-5-domain-500	A user account for the system administrator. By default, it is the only user account that is given full control over the system.
S-1-5-domain-501	Guest user account for people who do not have individual accounts. This user account does not require a password. By default, the Guest account is disabled.
S-1-5-domain-512	Domain Admins - a global group whose members are authorized to administer the domain. By default, the Domain Admins group is a member of the Administrators group on all computers that have joined a domain, including the domain controllers. Domain Admins is the default owner of any object that is created by any member of the group.
S-1-5-domain-513	Domain Users.
S-1-5-domain-514	Domain Guests - A global group that, by default, has only one member, the domain's built-in Guest account.
S-1-6	Site Server Authority.
S-1-7	Internet Site Authority.
S-1-8	Exchange Authority.
S-1-9	Resource Manager Authority.
S-1-16-xxxx	Mandatory Label Authority (SECURITY_MANDATORY_LABEL_AUTHORITY).

Duplicated SIDs

The problem with duplicated SIDs in a Workgroup of computers running Windows NT/2K/XP is only related to different user accounts having the same SID. This could lead to unexpected access to shared files or files stored on a removable storage: If some access control lists are set on a file, the actual permissions can be associated with a user SID. If this user SID is duplicated on another computer (because the computer SID is duplicated and because the user SIDs are built based on the computer SID + a sequential number), a user of a second computer having the same SID could have access to the files that the user of a first computer has protected.

Now the truth is that when the computers are joined into a domain (Active Directory or NT domain for instance), each computer has a unique Domain SID which is recomputed each time a computer enters a domain. Thus there are usually no real problems with Duplicated SIDs when the computers are members of a domain, especially if local user accounts are not used. If local user accounts are used, there is a potential security issue that is the same as the one described above when the computers are members of a Workgroup but that affects only the files and resources protected by local users, not by domain users.

In other words, duplicated SIDs are usually not a problem with Microsoft Windows systems. However Microsoft does provide the '"NewSID" utility to change a machine SID.

But other programs that detect SIDs might have problems with its security.

After NewSID's retirement, Microsoft engineer Mark Russinovich posted an article on his blog explaining the retirement of the NewSID stating that neither he nor the Windows security team could think of any situation where duplicate SIDs could cause any problems at all, against commonly accepted wisdom.

On November 1, 2009, Microsoft added the following to the NewSID download page:

Note: NewSID will be retired from Sysinternals on November 2, 2009.

At present, the only supported mechanism for duplicating disks for Windows operating systems is through use of SysPrep.

Machine SIDs

The machine SID is stored in the SECURITY registry hive located at SECURITY\SAM\Domains\Account, this key has two values F and V. The V value is a binary value that has the computer SID embedded within it at the end of its data (last 96 bits).

• "NewSID ensures that this SID is in a standard NT 4.0 format (3 32-bit subauthorities preceded by three 32-bit authority fields). Next, NewSID generates a new random SID for the computer. NewSID's generation takes great pains to create a truly random 96-bit value, which replaces the 96-bits of the 3 subauthority values that make up a computer SID."
  • From NewSID readme.

Decoding Machine SID

—The SID number is used in file, registry, service and users permissions. The machine SID is determined in hexadecimal form from here:

regedit.exe -> \HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\V (last 12 bytes) explorer.exe -> \%windir%\system32\config\SAM If the SAM file is missing at startup, a backup is retrieved in hexadecimal form here: regedit.exe -> \HKEY_LOCAL_MACHINE\SECURITY\Policy\PolAcDmS\@ (last 12 bytes) explorer.exe -> \%windir%\system32\config\SECURITY Sometimes the SID number is referenced in decimal form.

Security Accounts Manager, clark@hushmail.com

Example	2E,43,AC,40,C0,85,38,5D,07,E5,3B,2B
1) Divide the bytes into 3 sections:	2E,43,AC,40 - C0,85,38,5D - 07,E5,3B,2B
2) Reverse the order of bytes in each section:	40,AC,43,2E - 5D,38,85,C0 - 2B,3B,E5,07
3) Convert each section into decimal:	1085031214 - 1563985344 - 725345543
4) Add the machine SID prefix:	S-1-5-21-1085031214-1563985344-725345543

See also

• Access control
• Access Control Matrix
• Discretionary Access Control (DAC)
• Globally Unique Identifier (GUID)
• Mandatory Access Control (MAC)
• Role-Based Access Control (RBAC)
• Capability-based security
• Post-cloning operations

External links

• Official
  • Microsoft TechNet: Server 2003: Security Identifiers Technical Reference
  • MSKB154599: How to Associate a Username with a Security Identifier
  • MSKB243330: Well-known security identifiers in Windows operating systems
  • Support tools for Windows Server 2003 and Windows XP
• Other
  • Why Understanding SIDs is Important
  • Microsoft Security Descriptor (SID) Attributes : Tutorial Article about SID handling / converting in scripts