Menu
Home
People
Places
Arts
History
Plants & Animals
Science
Life & Culture
Technology
Reference.org
Security Identifier
open-in-new
<h2 id="overview">Overview</h2> <p>Windows grants privileges and access to resources based on <a href="/facts/Access_control_list/t38J9Vao">access control lists</a> (ACLs). Each entry on the list defines one SID and a set of permissions for that SID. When a user logs into a PC, Windows generates an <a href="/facts/Access_token/nsfEanhM">access token</a> that contains the user SID, the group SIDs to which the user account belongs, and the user privilege level. When a user requests access to a resource, its ACL is checked against the user's access token to permit or deny particular action on a particular object. </p> <h2 id="structure">Structure</h2> <p>The human-readable representation of a SID is a string that starts with "S-" and consists of several dash-separated numbers. For example, "S-1-5-21-3623811015-3361044348-30300820-1013" could be a user account's SID. The following table explains the components of this example SID. </p> Anatomy of a SID<table><tbody><tr><th>Component</th><th>Example</th><th>Explanation</th></tr><tr><th scope="row">Header</th><td>S</td><td>Identifies the string as a SID</td></tr><tr><th scope="row">Revision level</th><td>1</td><td>The version number of the SID specification. As of 2025, "1" is the only valid number.</td></tr><tr><th scope="row">Authority</th><td>5</td><td>See below</td></tr><tr><th scope="row">Subauthorities</th><td>21-3623811015-3361044348-30300820</td><td>In this example, "21" indicates a "<a href="/facts/Windows_domain/tAzIX31E">domain</a>" subauthority. The following 96-bit ID is a domain identifier.</td></tr><tr><th scope="row"><a href="/facts/Relative_ID/PjyHT8up">Relative ID</a> (RID)</th><td>1013</td><td>Uniquely identifies the principal within its subauthority group. In the context of domain accounts (which is the focus of our example), RIDs greater than 1000 indicate an admin-defined principal (as opposed to a predefined, built-in, or special-purpose generic principal).</td></tr></tbody></table> <p>Originally, SIDs were supposed to allow arbitrarily deep nesting, with each level allowed to create sub-authorities underneath itself. However, that goal was abandoned early in Windows NT development, when it was decided that it would be too unmanageable in practice; by then, however, the SID format had already been finalized and was in heavy use in the Windows code.<a class="footnote-ref" id="fnref:1" href="#fn:1"><sup>1</sup></a> </p> <h3>Identifier authority</h3> <p>Identifier authorities are formally defined as six-byte (48-bit) quantities. The identifier authority is expressed in decimal if its value is less than 232, otherwise in hexadecimal.<a class="footnote-ref" id="fnref:2" href="#fn:2"><sup>2</sup></a><a class="footnote-ref" id="fnref:3" href="#fn:3"><sup>3</sup></a> However, while this is the behavior formally defined by Microsoft, and implemented by the relevant Windows APIs (e.g. RtlConvertSidToUnicodeString),<a class="footnote-ref" id="fnref:4" href="#fn:4"><sup>4</sup></a> hexadecimal identifier authorities appear to have never been used in practice. All known values fit in the least significant byte, and the other 5 bytes are always zero. Identifier authorities are stored in <a href="/facts/Endianness/wbrQnyu3">big-endian</a> format, even on little-endian CPU architectures. </p> Valid identifier authority values<a class="footnote-ref" id="fnref:5" href="#fn:5"><sup>5</sup></a><a class="footnote-ref" id="fnref:6" href="#fn:6"><sup>6</sup></a><table><tbody><tr><th>Authority</th><th>Formal name</th><th>First introduced</th><th>Notes</th></tr><tr><td>0</td><td>Null Authority</td><td></td><td>e.g., "Nobody" (S-1-0-0)</td></tr><tr><td>1</td><td>World Authority</td><td></td><td>e.g., well-known groups such as "Everyone". (S-1-1-0)</td></tr><tr><td>2</td><td>Local Authority</td><td></td><td>e.g., flag SIDs like "CONSOLE LOGON"</td></tr><tr><td>3</td><td>Creator Authority</td><td></td><td></td></tr><tr><td>4</td><td>Non-unique Authority</td><td></td><td></td></tr><tr><td>5</td><td>NT Authority</td><td></td><td>Managed by the NT security subsystem. There are many sub-authorities such as "BUILTIN" and every <a href="/facts/Active_Directory/VWd9HhjU">Active Directory</a> <a href="/facts/Windows_domain/tAzIX31E">Domain</a></td></tr><tr><td>6<a class="footnote-ref" id="fnref:7" href="#fn:7"><sup>7</sup></a><a class="footnote-ref" id="fnref:8" href="#fn:8"><sup>8</sup></a></td><td>Site Server Authority</td><td><a href="/facts/Windows_XP/IozrkAYS">Windows XP</a></td><td></td></tr><tr><td>7<a class="footnote-ref" id="fnref:9" href="#fn:9"><sup>9</sup></a><a class="footnote-ref" id="fnref:10" href="#fn:10"><sup>10</sup></a></td><td>Internet Site Authority</td><td><a href="/facts/Windows_XP/IozrkAYS">Windows XP</a></td><td></td></tr><tr><td>8<a class="footnote-ref" id="fnref:11" href="#fn:11"><sup>11</sup></a><a class="footnote-ref" id="fnref:12" href="#fn:12"><sup>12</sup></a><a class="footnote-ref" id="fnref:13" href="#fn:13"><sup>13</sup></a></td><td>Exchange Authority</td><td><a href="/facts/Windows_XP/IozrkAYS">Windows XP</a></td><td></td></tr><tr><td>9<a class="footnote-ref" id="fnref:14" href="#fn:14"><sup>14</sup></a><a class="footnote-ref" id="fnref:15" href="#fn:15"><sup>15</sup></a><a class="footnote-ref" id="fnref:16" href="#fn:16"><sup>16</sup></a></td><td>Resource Manager Authority</td><td><a href="/facts/Windows_Server_2003/3vIJam5L">Windows Server 2003</a></td><td></td></tr><tr><td>10<a class="footnote-ref" id="fnref:17" href="#fn:17"><sup>17</sup></a></td><td>Passport Authority</td><td></td><td></td></tr><tr><td>11<a class="footnote-ref" id="fnref:18" href="#fn:18"><sup>18</sup></a></td><td>Microsoft Account Authority</td><td><a href="/facts/Windows_8/eRtw96T3">Windows 8</a></td><td></td></tr><tr><td>12</td><td>Azure Active Directory</td><td><a href="/facts/Windows_10/be9IHehJ">Windows 10</a></td><td></td></tr><tr><td>15<a class="footnote-ref" id="fnref:19" href="#fn:19"><sup>19</sup></a><a class="footnote-ref" id="fnref:20" href="#fn:20"><sup>20</sup></a><a class="footnote-ref" id="fnref:21" href="#fn:21"><sup>21</sup></a></td><td>App Package Authority (Capability SIDs)</td><td><a href="/facts/Windows_Server_2012/W1vuUlSB">Windows Server 2012</a></td><td>All capability SIDs begin at S-1-15-3. By design, a capability SID does not resolve to a friendly name. The most commonly used capability SID is S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681</td></tr><tr><td>16<a class="footnote-ref" id="fnref:22" href="#fn:22"><sup>22</sup></a></td><td>Mandatory Label Authority</td><td><a href="/facts/Windows_Vista/IASEUCTB">Windows Vista</a></td><td>Used as part of <a href="/facts/Mandatory_Integrity_Control/5XGcMsQE">Mandatory Integrity Control</a></td></tr><tr><td>17<a class="footnote-ref" id="fnref:23" href="#fn:23"><sup>23</sup></a></td><td>Scoped Policy ID Authority</td><td></td><td></td></tr><tr><td>18<a class="footnote-ref" id="fnref:24" href="#fn:24"><sup>24</sup></a></td><td>Authentication Authority</td><td></td><td></td></tr><tr><td>19<a class="footnote-ref" id="fnref:25" href="#fn:25"><sup>25</sup></a></td><td>Process Trust Authority</td><td></td></tr></tbody></table> <h3>Subauthority</h3> S-1-5 subauthority values<a class="footnote-ref" id="fnref:26" href="#fn:26"><sup>26</sup></a><a class="footnote-ref" id="fnref:27" href="#fn:27"><sup>27</sup></a><a class="footnote-ref" id="fnref:28" href="#fn:28"><sup>28</sup></a><table><tbody><tr><th>Decimal</th><th>Name</th><th>First introduced</th><th>Format and purpose</th></tr><tr><td>8<a class="footnote-ref" id="fnref:29" href="#fn:29"><sup>29</sup></a></td><td>Proxy</td><td><a href="/facts/Windows_Server_2003/3vIJam5L">Windows Server 2003</a></td><td>S-1-5-8 is the SID of the "SECURITY_NT_AUTHORITY" proxy.<a class="footnote-ref" id="fnref:30" href="#fn:30"><sup>30</sup></a></td></tr><tr><td>18</td><td>LocalSystem</td><td><a href="/facts/Windows_NT_3.1/2mdmR1cL">Windows NT 3.1</a></td><td>S-1-5-18 is the SID of the LocalSystem account on all Windows machines.</td></tr><tr><td>19</td><td>LocalService</td><td></td><td>S-1-5-19 is the SID of the LocalService account on all Windows machines.</td></tr><tr><td>20</td><td>NetworkService</td><td></td><td>S-1-5-20 is the SID of the NetworkService account on all Windows machines.</td></tr><tr><td>21</td><td>Domain</td><td></td><td>S-1-5-21-<Domain ID>-<RID>, where <Domain ID> is in the form of <32-bit>-<32-bit>-<32-bit>. See below for details.</td></tr><tr><td>32</td><td>Users</td><td><a href="/facts/Windows_7/tldLdbnX">Windows 7</a></td><td>S-1-5-32-<RID>. Example: S-1-5-32-544 (the built-in Administrators group).<p>The resulting SID pertains a predefined, special-purpose user group, and is valid on all Windows machines. RID could only be one the predefined ones. </p></td></tr><tr><td>64</td><td>Authentication</td><td></td><td>S-1-5-64-<RID>, where <RID> is one of the following:<ul><li>10: NTLM</li><li>14: SChannel</li><li>21: Digest</li></ul></td></tr><tr><td>80</td><td>NT Service</td><td><a href="/facts/Windows_Vista/IASEUCTB">Windows Vista</a></td><td>S-1-5-80-<RID>, where <RID> is a service identifier. "0" (zero) is reserved for the ALL SERVICES group (hence, S-1-5-80-0's <a href="/facts/Fully_qualified_name/V85g6Cco">fully qualified name</a> is NT SERVICE\ALL SERVICES).</td></tr><tr><td>82</td><td>IIS AppPool</td><td><a href="/facts/Windows_7/tldLdbnX">Windows 7</a></td><td></td></tr><tr><td>83-0</td><td>Virtual Machines</td><td><a href="/facts/Windows_7/tldLdbnX">Windows 7</a></td><td>S-1-5-83-0 is the SID of the "NT VIRTUAL MACHINE\Virtual Machines" group, which maintains a list of all Hyper-V virtual machines.</td></tr><tr><td>83-1</td><td>Virtual machine</td><td><a href="/facts/Windows_7/tldLdbnX">Windows 7</a></td><td>S-1-5-83-1-<ID1>-<ID2>-<ID3>-<ID4>.<p>The resulting SID pertains a Hyper-V virtual machine.</p></td></tr><tr><td>90<a class="footnote-ref" id="fnref:31" href="#fn:31"><sup>31</sup></a></td><td>Windows Manager</td><td><a href="/facts/Windows_7/tldLdbnX">Windows 7</a></td><td>S-1-5-90-0 is the SID of the "Windows Manager Group", a built-in group that maintains all virtual accounts of the <a href="/facts/Desktop_Window_Manager/Fo1XazIJ">Desktop Windows Manager</a> (DWM).<p>S-1-5-90-0-<RID>, where <RID> is a number, is the SID format of a DWM virtual account. For example, S-1-5-90-0-1 pertains DWM-1.</p></td></tr><tr><td>96</td><td>User-Mode Driver Framework</td><td><a href="/facts/Windows_7/tldLdbnX">Windows 7</a></td><td>S-1-5-96-0-<RID>, where <RID> is a number, is the SID format of a <a href="/facts/User-Mode_Driver_Framework/zIe9KKHk">User-Mode Driver Framework</a> (UMDF) virtual account. For example, S-1-5-96-0-1 pertains UMDF-1. The User-mode Font Driver Host (fontdrvhost.exe) runs in the context of a UMDF account.</td></tr></tbody></table> <h2 id="domain-sids">Domain SIDs</h2> <p>SIDs that start with "S-1-5-21" are noticeably longer than most other SIDs (with the notable exception of service SIDs). Their general format is: S-1-5-21-<Domain ID>-<RID>, where <Domain ID> is in the form of <32-bit>-<32-bit>-<32-bit>. </p><p>The Domain ID uniquely identifies a <a href="/facts/Windows_domain/tAzIX31E">Windows domain</a>. The RID specifies a principal (user account, group account, or computer account) within that domain. </p><p>If the RID portion is greater than 1000, the resulting SID pertains an admin-defined user account, user group, or computer account, e.g., S-1-5-21-3361044348-303008203623811015-1001. The name of this account could be anything, e.g., Domain.local\JaneDoe. </p><p>If the RID portion is smaller than 1000, the resulting SID pertains a predefined (built-in) user account or user group. For example, RID 500 identifies the controversial "Administrator" user account while RID 512 pertains the "Domain Admins" group. </p> <h3>Machine SIDs</h3> <p>Machine SIDs are variety of domain SIDs (S-1-5-21) with a 96-bit domain ID (a machine is considered its own local domain) but no RID. Their general format is: S-1-5-21-<Machine ID>, where <Machine ID> is in the form of <32-bit>-<32-bit>-<32-bit>. </p><p>The machine SID is stored in the SECURITY hive of the <a href="/facts/Windows_Registry/cH9RlHTp">Windows Registry</a>, more specifically at HKEY_LOCAL_MACHINE\SECURITY\SAM\Domains\Account. This key has two values: F and V. The latter is a raw binary value that has the machine SID embedded within it at the end of its data (last 96 bits).<a class="footnote-ref" id="fnref:32" href="#fn:32"><sup>32</sup></a> (Some sources[<i>example needed</i>] state that it is stored in the SAM hive instead.) A backup is located at SECURITY\Policy\PolAcDmS\@. </p> <blockquote><p>NewSID ensures that this SID is in a standard NT 4.0 format (3 32-bit subauthorities preceded by three 32-bit authority fields). Next, NewSID generates a new random SID for the computer. NewSID's generation takes great pains to create a truly random 96-bit value, which replaces the 96-bits of the 3 subauthority values that make up a computer SID.</p>— NewSID readme<a class="footnote-ref" id="fnref:33" href="#fn:33"><sup>33</sup></a></blockquote> <p>The machine SID is stored in a raw-bytes form in the registry. To convert it into the more common numeric form, one interprets it as three, <a href="/facts/Little_endian/wbrQnyu3">little endian</a>, 32-bit integers, converts them to decimal, and add hyphens between them. </p> Example of decoding machine SID<table><tbody><tr><th scope="row">Raw form (hexadecimal representation)</th><td>2E,43,AC,40,C0,85,38,5D,07,E5,3B,2B</td></tr><tr><th scope="row">Split the bytes into 3 groups of four octets</th><td>2E,43,AC,40 - C0,85,38,5D - 07,E5,3B,2B</td></tr><tr><th scope="row">Reverse the order of bytes in each group</th><td>40,AC,43,2E - 5D,38,85,C0 - 2B,3B,E5,07</td></tr><tr><th scope="row">Convert each group into decimal</th><td>1085031214 - 1563985344 - 725345543</td></tr><tr><th scope="row">Add the machine SID prefix</th><td>S-1-5-21-1085031214-1563985344-725345543</td></tr></tbody></table> <h2 id="service-sids">Service SIDs</h2> <p>Service SIDs are a feature of service isolation, introduced in <a href="/facts/Windows_Vista/IASEUCTB">Windows Vista</a> and <a href="/facts/Windows_Server_2008/hrcPjTCH">Windows Server 2008</a>.<a class="footnote-ref" id="fnref:34" href="#fn:34"><sup>34</sup></a> Any service with the "unrestricted" SID-type property will have a service-specific SID added to the access token of the service host process, allowing permissions for a single service to be managed without necessitating the creation of service accounts. </p><p>Each service SID is a local, machine-level SID that has the general form of S-1-5-80-<Service ID>. To generate <Service ID>, Windows copies the service name (in <a href="/facts/UTF-16/ofSmbCem">UTF-16</a> encoding), converts all characters to uppercase, and calculates the <a href="/facts/SHA-1/LDYCV1je">SHA-1</a> digest of said uppercase name. This digest becomes the <Service ID>. The <a href="/facts/Sc_(command)/qzNquuK6">sc.exe</a> <a href="/facts/Command_(computing)/zUrvQbFy">command</a> can be used to generate this special SID value; for example, given the "dnscache" service: </p> C:\>sc query NAME: dnscache SERVICE SID: S-1-5-80-859482183-879914841-863379149-1145462774-2388618682 <p>Therefore, the "dnscache" service can be referred to as either NT SERVICE\dnscache or S-1-5-80-859482183-879914841-863379149-1145462774-2388618682. Since a Service SID is determined exclusively by the service name, the value of the SID for a given service is always the same across all machines wherever the service runs. </p> <h2 id="duplicated-sids">Duplicated SIDs</h2> <p>A common method of mass-producing Windows PCs is to install Windows on a template machine, and duplicate its disk sector by sector to other identical machines. As a result, these mass-produced machines are identical in every respect, including their SIDs.<a class="footnote-ref" id="fnref:35" href="#fn:35"><sup>35</sup></a> </p><p>Microsoft engineer <a href="/facts/Mark_Russinovich/xutjgFN2">Mark Russinovich</a> is the creator of a <a href="/facts/Utility_software/Hn3XtISQ">utility</a> called NewSID, the purpose of which is to solve "The SID Duplication Problem."<a class="footnote-ref" id="fnref:36" href="#fn:36"><sup>36</sup></a> Microsoft has retired the utility on November 2, 2009, because, Mark and the Windows security team have concluded that duplicate SIDs do not pose any problem whatsoever.<a class="footnote-ref" id="fnref:37" href="#fn:37"><sup>37</sup></a> </p> <h2 id="see-also">See also</h2> <ul><li><a href="/facts/Access_control/08zE5Pz8">Access control</a></li> <li><a href="/facts/Access_Control_Matrix/TX8U4zIE">Access Control Matrix</a></li> <li><a href="/facts/Discretionary_Access_Control/MTQRM7nr">Discretionary Access Control</a> (DAC)</li> <li><a href="/facts/Globally_Unique_Identifier/SUtkYJPe">Globally Unique Identifier</a> (GUID)</li> <li><a href="/facts/Mandatory_Access_Control/yvtGFacq">Mandatory Access Control</a> (MAC)</li> <li><a href="/facts/Role-Based_Access_Control/dPN1ohBE">Role-Based Access Control</a> (RBAC)</li> <li><a href="/facts/Capability-based_security/negzSwhS">Capability-based security</a></li> <li><a href="/facts/Disk_cloning/0P2s4M4N">Post-cloning operations</a></li></ul> <h2 id="footnotes">Footnotes</h2> <h2 id="external-links">External links</h2> <ul><li>Official <ul><li><a href="http://portal.sivarajan.com/2011/09/objectsid-and-active-directory.html">ObjectSID and Active Directory</a></li> <li><a href="https://technet.microsoft.com/en-us/library/cc782090.aspx">Microsoft TechNet: Server 2003: Security Identifiers Technical Reference</a></li> <li><a href="http://support.microsoft.com/kb/154599">MSKB154599: How to Associate a Username with a Security Identifier</a></li> <li><a href="http://support.microsoft.com/kb/243330">MSKB243330: Well-known security identifiers in Windows operating systems</a></li> <li><a href="http://www.microsoft.com/downloads/details.aspx?familyid=6EC50B78-8BE1-4E81-B3BE-4E7AC4F0912D&displaylang=en">Support tools for Windows Server 2003 and Windows XP</a></li> <li><a href="https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/security-identifiers">Security Identifiers - Windows Security docs</a></li></ul></li> <li>Other <ul><li><a href="http://servermigrator.blogspot.com/2006/02/why-understanding-sids-is-important.html">Why Understanding SIDs is Important</a></li> <li><a href="http://www.selfadsi.org/deep-inside/microsoft-sid-attributes.htm">Microsoft Security Descriptor (SID) Attributes : Tutorial Article about SID handling / converting in scripts</a></li></ul></li></ul> <h2 id="references">References</h2> <ol> <li id="fn:1"><p>"[MS-AZOD]: Security Identifiers (SIDs)". learn.microsoft.com. 2022-06-14. Retrieved 2024-12-29. <a href="https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-azod/ecc7dfba-77e1-4e03-ab99-114b349c7164" target="_blank">https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-azod/ecc7dfba-77e1-4e03-ab99-114b349c7164</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li> <li id="fn:2"><p>"[MS-DTYP]: SID String Format Syntax". learn.microsoft.com. 2023-12-12. Retrieved 2024-12-29. <a href="https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/c92a27b1-c772-4fa7-a432-15df5f1b66a1" target="_blank">https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/c92a27b1-c772-4fa7-a432-15df5f1b66a1</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li> <li id="fn:3"><p>"RtlConvertSidToUnicodeString function (ntifs.h) - Windows drivers". learn.microsoft.com. 2022-11-04. Retrieved 2024-12-29. <a href="https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-rtlconvertsidtounicodestring" target="_blank">https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-rtlconvertsidtounicodestring</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></p></li> <li id="fn:4"><p>"RtlConvertSidToUnicodeString function (ntifs.h) - Windows drivers". learn.microsoft.com. 2022-11-04. Retrieved 2024-12-29. <a href="https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-rtlconvertsidtounicodestring" target="_blank">https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-rtlconvertsidtounicodestring</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></p></li> <li id="fn:5"><p>"Well-known security identifiers in Windows operating systems". support.microsoft.com. Retrieved 12 December 2019. <a href="https://support.microsoft.com/en-hk/help/243330/well-known-security-identifiers-in-windows-operating-systems" target="_blank">https://support.microsoft.com/en-hk/help/243330/well-known-security-identifiers-in-windows-operating-systems</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></p></li> <li id="fn:6"><p>openspecs-office. "[MS-DTYP]: Well-Known SID Structures". docs.microsoft.com. Retrieved 2020-09-03. <a href="https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab" target="_blank">https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab</a> <a href="#fnref:6" class="footnote-back-ref">↩</a></p></li> <li id="fn:7"><p>"[MS-PAC]: SID Filtering and Claims Transformation". learn.microsoft.com. 2023-06-28. Retrieved 2024-12-29. <a href="https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pac/55fc19f2-55ba-4251-8a6a-103dd7c66280" target="_blank">https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pac/55fc19f2-55ba-4251-8a6a-103dd7c66280</a> <a href="#fnref:7" class="footnote-back-ref">↩</a></p></li> <li id="fn:8"><p>Honeycutt, Jerry (2005). Microsoft Windows Registry Guide. Microsoft Press. p. 11. ISBN 978-0-7356-2218-0. <a href="978-0-7356-2218-0" target="_blank">978-0-7356-2218-0</a> <a href="#fnref:8" class="footnote-back-ref">↩</a></p></li> <li id="fn:9"><p>"[MS-PAC]: SID Filtering and Claims Transformation". learn.microsoft.com. 2023-06-28. Retrieved 2024-12-29. <a href="https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pac/55fc19f2-55ba-4251-8a6a-103dd7c66280" target="_blank">https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pac/55fc19f2-55ba-4251-8a6a-103dd7c66280</a> <a href="#fnref:9" class="footnote-back-ref">↩</a></p></li> <li id="fn:10"><p>Honeycutt, Jerry (2005). Microsoft Windows Registry Guide. Microsoft Press. p. 11. ISBN 978-0-7356-2218-0. <a href="978-0-7356-2218-0" target="_blank">978-0-7356-2218-0</a> <a href="#fnref:10" class="footnote-back-ref">↩</a></p></li> <li id="fn:11"><p>"[MS-PAC]: SID Filtering and Claims Transformation". learn.microsoft.com. 2023-06-28. Retrieved 2024-12-29. <a href="https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pac/55fc19f2-55ba-4251-8a6a-103dd7c66280" target="_blank">https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pac/55fc19f2-55ba-4251-8a6a-103dd7c66280</a> <a href="#fnref:11" class="footnote-back-ref">↩</a></p></li> <li id="fn:12"><p>Honeycutt, Jerry (2005). Microsoft Windows Registry Guide. Microsoft Press. p. 11. ISBN 978-0-7356-2218-0. <a href="978-0-7356-2218-0" target="_blank">978-0-7356-2218-0</a> <a href="#fnref:12" class="footnote-back-ref">↩</a></p></li> <li id="fn:13"><p>"Outlook2007CodeSamples/SampleWrappedPSTStoreProvider/WrapPST/EdkMdb.h at 10edfa1ce7e6895a4788ad7c766b9120bec0128d · microsoft/Outlook2007CodeSamples". GitHub. Retrieved 2024-12-29. <a href="https://github.com/microsoft/Outlook2007CodeSamples/blob/10edfa1ce7e6895a4788ad7c766b9120bec0128d/SampleWrappedPSTStoreProvider/WrapPST/EdkMdb.h#L1183" target="_blank">https://github.com/microsoft/Outlook2007CodeSamples/blob/10edfa1ce7e6895a4788ad7c766b9120bec0128d/SampleWrappedPSTStoreProvider/WrapPST/EdkMdb.h#L1183</a> <a href="#fnref:13" class="footnote-back-ref">↩</a></p></li> <li id="fn:14"><p>Honeycutt, Jerry (2005). Microsoft Windows Registry Guide. Microsoft Press. p. 11. ISBN 978-0-7356-2218-0. <a href="978-0-7356-2218-0" target="_blank">978-0-7356-2218-0</a> <a href="#fnref:14" class="footnote-back-ref">↩</a></p></li> <li id="fn:15"><p>See "Custom Principals" section on https://msdn.microsoft.com/en-us/library/aa480244.aspx <a href="https://msdn.microsoft.com/en-us/library/aa480244.aspx" target="_blank">https://msdn.microsoft.com/en-us/library/aa480244.aspx</a> <a href="#fnref:15" class="footnote-back-ref">↩</a></p></li> <li id="fn:16"><p>"Larry Osterman's WebLog". 17 July 2020. <a href="http://blogs.msdn.com/larryosterman/archive/2004/09/01/224051.aspx" target="_blank">http://blogs.msdn.com/larryosterman/archive/2004/09/01/224051.aspx</a> <a href="#fnref:16" class="footnote-back-ref">↩</a></p></li> <li id="fn:17"><p>"[MS-PAC]: SID Filtering and Claims Transformation". learn.microsoft.com. 2023-06-28. Retrieved 2024-12-29. <a href="https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pac/55fc19f2-55ba-4251-8a6a-103dd7c66280" target="_blank">https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pac/55fc19f2-55ba-4251-8a6a-103dd7c66280</a> <a href="#fnref:17" class="footnote-back-ref">↩</a></p></li> <li id="fn:18"><p>"Example impact of Microsoft Accounts on Windows APIs in Windows 8/8.1 – Windows SDK Support Team Blog". blogs.msdn.microsoft.com. 12 December 2014. <a href="https://blogs.msdn.microsoft.com/winsdk/2014/12/12/example-impact-of-microsoft-accounts-on-windows-apis-in-windows-88-1/" target="_blank">https://blogs.msdn.microsoft.com/winsdk/2014/12/12/example-impact-of-microsoft-accounts-on-windows-apis-in-windows-88-1/</a> <a href="#fnref:18" class="footnote-back-ref">↩</a></p></li> <li id="fn:19"><p>"Security identifiers". support.microsoft.com. 28 August 2021. Retrieved 2020-09-02. <a href="https://support.microsoft.com/en-us/help/243330/well-known-security-identifiers-in-windows-operating-systems" target="_blank">https://support.microsoft.com/en-us/help/243330/well-known-security-identifiers-in-windows-operating-systems</a> <a href="#fnref:19" class="footnote-back-ref">↩</a></p></li> <li id="fn:20"><p>"Some SIDs do not resolve into friendly names". support.microsoft.com. 24 September 2021. Retrieved 2020-09-02. <a href="https://support.microsoft.com/en-us/help/4502539/some-sids-do-not-resolve-into-friendly-names" target="_blank">https://support.microsoft.com/en-us/help/4502539/some-sids-do-not-resolve-into-friendly-names</a> <a href="#fnref:20" class="footnote-back-ref">↩</a></p></li> <li id="fn:21"><p>"Capability SID Constants (Winnt.h) - Win32 apps". docs.microsoft.com. Retrieved 2020-09-02. <a href="https://docs.microsoft.com/en-us/windows/win32/secauthz/capability-sid-constants" target="_blank">https://docs.microsoft.com/en-us/windows/win32/secauthz/capability-sid-constants</a> <a href="#fnref:21" class="footnote-back-ref">↩</a></p></li> <li id="fn:22"><p>"SYSTEM_MANDATORY_LABEL_ACE (winnt.h) - Win32 apps". learn.microsoft.com. 2024-02-22. Retrieved 2024-12-29. <a href="https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-system_mandatory_label_ace" target="_blank">https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-system_mandatory_label_ace</a> <a href="#fnref:22" class="footnote-back-ref">↩</a></p></li> <li id="fn:23"><p>"[MS-DTYP]: SID_IDENTIFIER_AUTHORITY". learn.microsoft.com. 2020-10-30. Retrieved 2024-12-29. <a href="https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/c6ce4275-3d90-4890-ab3a-514745e4637e" target="_blank">https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/c6ce4275-3d90-4890-ab3a-514745e4637e</a> <a href="#fnref:23" class="footnote-back-ref">↩</a></p></li> <li id="fn:24"><p>"[MS-DTYP]: SID_IDENTIFIER_AUTHORITY". learn.microsoft.com. 2020-10-30. Retrieved 2024-12-29. <a href="https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/c6ce4275-3d90-4890-ab3a-514745e4637e" target="_blank">https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/c6ce4275-3d90-4890-ab3a-514745e4637e</a> <a href="#fnref:24" class="footnote-back-ref">↩</a></p></li> <li id="fn:25"><p>"Sandboxing Antimalware Products for Fun and Profit — Elastic Security Labs". www.elastic.co. 2023-02-21. Retrieved 2024-12-29. <a href="https://www.elastic.co/security-labs/sandboxing-antimalware-products" target="_blank">https://www.elastic.co/security-labs/sandboxing-antimalware-products</a> <a href="#fnref:25" class="footnote-back-ref">↩</a></p></li> <li id="fn:26"><p>"Security identifiers". support.microsoft.com. 28 August 2021. Retrieved 2020-09-02. <a href="https://support.microsoft.com/en-us/help/243330/well-known-security-identifiers-in-windows-operating-systems" target="_blank">https://support.microsoft.com/en-us/help/243330/well-known-security-identifiers-in-windows-operating-systems</a> <a href="#fnref:26" class="footnote-back-ref">↩</a></p></li> <li id="fn:27"><p>"IIS AppPool Identity SIDs". winterdom. 2020-09-02. <a href="https://winterdom.com/2014/05/16/iis-apppool-identity-sids" target="_blank">https://winterdom.com/2014/05/16/iis-apppool-identity-sids</a> <a href="#fnref:27" class="footnote-back-ref">↩</a></p></li> <li id="fn:28"><p>openspecs-office. "[MS-DTYP]: Well-Known SID Structures". docs.microsoft.com. Retrieved 2020-09-03. <a href="https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab" target="_blank">https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab</a> <a href="#fnref:28" class="footnote-back-ref">↩</a></p></li> <li id="fn:29"><p>openspecs-office. "[MS-DTYP]: Well-Known SID Structures". docs.microsoft.com. Retrieved 2020-09-03. <a href="https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab" target="_blank">https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab</a> <a href="#fnref:29" class="footnote-back-ref">↩</a></p></li> <li id="fn:30"><p>openspecs-office. "[MS-DTYP]: Well-Known SID Structures". docs.microsoft.com. Retrieved 2020-09-03. <a href="https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab" target="_blank">https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab</a> <a href="#fnref:30" class="footnote-back-ref">↩</a></p></li> <li id="fn:31"><p>openspecs-office. "[MS-DTYP]: Well-Known SID Structures". docs.microsoft.com. Retrieved 2020-09-03. <a href="https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab" target="_blank">https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab</a> <a href="#fnref:31" class="footnote-back-ref">↩</a></p></li> <li id="fn:32"><p>"MS TechNet NewSID Utility - How It Works". Knowledge Base. Microsoft. November 1, 2006. Retrieved 2008-08-05. <a href="https://technet.microsoft.com/en-us/sysinternals/bb897418.aspx" target="_blank">https://technet.microsoft.com/en-us/sysinternals/bb897418.aspx</a> <a href="#fnref:32" class="footnote-back-ref">↩</a></p></li> <li id="fn:33"><p>"NewSID v4.10". Windows Sysinternals. Microsoft. 2006-11-01. <a href="https://learn.microsoft.com/en-us/sysinternals/downloads/newsid" target="_blank">https://learn.microsoft.com/en-us/sysinternals/downloads/newsid</a> <a href="#fnref:33" class="footnote-back-ref">↩</a></p></li> <li id="fn:34"><p>"Windows Service Isolation Feature". Article. Windows IT Pro. June 6, 2012. Retrieved December 7, 2012. <a href="http://www.windowsitpro.com/article/authentication/windows-service-isolation-143215" target="_blank">http://www.windowsitpro.com/article/authentication/windows-service-isolation-143215</a> <a href="#fnref:34" class="footnote-back-ref">↩</a></p></li> <li id="fn:35"><p>"NewSID v4.10". Windows Sysinternals. Microsoft. 2006-11-01. <a href="https://learn.microsoft.com/en-us/sysinternals/downloads/newsid" target="_blank">https://learn.microsoft.com/en-us/sysinternals/downloads/newsid</a> <a href="#fnref:35" class="footnote-back-ref">↩</a></p></li> <li id="fn:36"><p>"NewSID v4.10". Windows Sysinternals. Microsoft. 2006-11-01. <a href="https://learn.microsoft.com/en-us/sysinternals/downloads/newsid" target="_blank">https://learn.microsoft.com/en-us/sysinternals/downloads/newsid</a> <a href="#fnref:36" class="footnote-back-ref">↩</a></p></li> <li id="fn:37"><p>Russinovich, Mark (2009-11-03). "The Machine SID Duplication Myth". Mark's Blog. Microsoft – via Microsoft Learn's blog archive. <a href="/wiki/Mark_Russinovich" target="_blank">/wiki/Mark_Russinovich</a> <a href="#fnref:37" class="footnote-back-ref">↩</a></p></li> </ol>