Security Identifier

This article describes how security identifiers (SIDs) work with accounts and groups in the Windows Server operating system. Each time a user signs in, the system creates an access token for that user. The access token contains the user's SID, user rights, and the SIDs for any groups the user belongs to. This token provides the security context for whatever actions the user performs on that computer. In addition to the uniquely created domain-specific SIDs that are assigned to specific users and groups, there are well-known SIDs that identify generic groups and generic users. For example, the Everyone and World SIDs each identify a group that includes all users. Well-known SIDs have values that remain constant across all operating systems. SIDs are a fundamental building block of the Windows security model. They work with specific components of the authorization and access control technologies in the security infrastructure of the Windows Server operating systems. This design helps protect access to network resources and provides a more secure computing environment. Users refer to accounts by the account name. Internally, the operating system refers to accounts and processes that run in the security context of the account by using their SIDs. For domain accounts, the SID of a security principal is created by concatenating the SID of the domain with a relative identifier (RID) for the account. SIDs are unique within their scope (domain or local), and they're never reused. For every local account and group, the SID is unique for the computer where it's created. No two accounts or groups on the computer ever share the same SID. Likewise, for every domain account and group, the SID is unique within an enterprise. As a result, the SID of an account or group in one domain never matches the SID of an account or group in any other domain in the enterprise. SIDs always remain unique. Security authorities never issue the same SID twice, and they never reuse SIDs for deleted accounts. For example, if a user with a user account in a Windows domain leaves their job, an administrator deletes their Active Directory account, including the SID that identifies the account. If they later return to a different job at the same company, an administrator creates a new account, and the Windows Server operating system generates a new SID. The new SID doesn't match the old one, so none of the user's access from their old account is transferred to the new account. Both their accounts represent two different security principals. A SID is a data structure in binary format that contains a variable number of values. The first values in the structure contain information about the SID structure. The remaining values are arranged in a hierarchy (similar to a telephone number), and they identify the SID-issuing authority (for example, NT Authority), the SID-issuing domain, and a particular security principal or group. The following image illustrates the structure of a SID. The SID's most important information is contained in the series of subauthority values. The first part of the series (-Y1-Y2-Y n -1) is the domain identifier. This element of the SID becomes significant in an enterprise with several domains. Specifically, the domain identifier differentiates SIDs that one domain issues from SIDs that all other domains in the enterprise issue. No two domains in an enterprise share the same domain identifier. SIDs for built-in accounts and groups always have the same domain identifier value, 32. This value identifies the domain, Builtin, which exists on every computer that's running a version of the Windows Server operating system. It's never necessary to distinguish one computer's built-in accounts and groups from another computer's built-in accounts and groups, because they're local in scope. They're local to a single computer or, with domain controllers for a network domain, they're local to several computers that are acting as one. Built-in accoun