Security Identifier


In the context of the Microsoft Windows NT line of operating systems, a Security Identifier is a unique, immutable identifier of a user, user group, or other security principal. A security principal has a single SID for life, and all properties of the principal, including its name, are associated with the SID. This design allows a principal to be renamed without affecting the security attributes of objects that refer to the principal.

Overview

Windows grants or denies access and privileges to resources based on access control lists, which use SIDs to uniquely identify users and their group memberships. When a user logs into a computer, an access token is generated that contains user and group SIDs and user privilege level. When a user requests access to a resource, the access token is checked against the ACL to permit or deny particular action on a particular object.
SIDs are useful for troubleshooting issues with security audits, Windows server and domain migrations.
The format of a SID can be illustrated using the following example: "S-1-5-21-3623811015-3361044348-30300820-1013";
S1521-3623811015-3361044348-303008201013
The string is a SID.The revision level.The identifier authority value.Subauthority value
In this case, a domain with a unique identifier		A Relative ID. Any group or user that is not created by default will have a Relative ID of 1000 or greater.

Identifier Authority Values

Known identifier authority values are:
DecimalNameDisplay NameFirst IntroducedReferencesNotes-
0Null Authoritye.g. "Nobody"-
1World Authoritye.g. well known groups such as "Everyone".-
2Local Authoritye.g. flag SIDs like "CONSOLE LOGON"-
3Creator Authority-
4Non-unique Authority-
5NT AuthorityNT AUTHORITY\Managed by the NT security subsystem. There are many sub-authorities such as "BUILTIN" and every Active Directory Domain-
7Internet$Internet$\Windows 7-
9Resource Manager AuthorityWindows Server 2003-
11Microsoft Account AuthorityMicrosoftAccount\Windows 8-
12Azure Active DirectoryAzureAD\Windows 10-
16Mandatory Label\Windows VistaUsed as part of Mandatory Integrity Control
18Asserted Identity-

Machine SIDs

The machine SID is stored in the SECURITY registry hive located at SECURITY\SAM\Domains\Account, this key has two values F and V. The V value is a binary value that has the computer SID embedded within it at the end of its data. A backup is located at SECURITY\Policy\PolAcDmS\@.
The machine SID subauthority format is used for domain SIDs too. A machine is considered its own local domain in this case.

Decoding Machine SID

The machine SID is stored in a raw-bytes form in the registry. To convert it into the more common numeric form, one interprets it as three little endian 32-bit integers, converts them to decimal, and add hyphens between them.
Example
1) Divide the bytes into 3 sections:
2) Reverse the order of bytes in each section:
3) Convert each section into decimal:
4) Add the machine SID prefix:

Other Uses

The machine SID is also used by some free-trial programs, such as Start8, to identify the computer so that it cannot restart the trial.

Service SIDs

Service SIDs are a feature of service isolation, a security feature introduced in Windows Vista and Windows Server 2008. Any service with the "unrestricted" SID-type property will have a service-specific SID added to the access token of the service host process. The purpose of Service SIDs is to allow permissions for a single service to be managed without necessitating the creation of service accounts, an administrative overhead.
Each service SID is a local, machine-level SID generated from the service name using the following formula:
S-1-5-80-
The sc.exe command can be used to generate an arbitrary service SID:

C:\>sc.exe showsid dnscache
NAME: dnscache
SERVICE SID: S-1-5-80-859482183-879914841-863379149-1145462774-2388618682
STATUS: Active

The service can also be referred to as NT SERVICE\.

Duplicated SIDs

In a Workgroup of computers running Windows NT/2K/XP, it is possible for a user to have unexpected access to shared files or files stored on a removable storage. This can be prevented by setting access control lists on a susceptible file, such that the effective permissions is determined by the user SID. If this user SID is duplicated on another computer, a user of a second computer having the same SID could have access to the files that the user of a first computer has protected. This can often happen when machine SIDs are duplicated by a disk clone, common for pirate copies. The user SIDs are built based on the machine SID and a sequential relative ID.
When the computers are joined into a domain, each computer is provided a unique Domain SID which is recomputed each time a computer enters a domain. This SID is similar to the machine SID. As a result, there are typically no significant problems with duplicate SIDs when the computers are members of a domain, especially if local user accounts are not used. If local user accounts are used, there is a potential security issue similar to the one described above, but the issue is limited to the files and resources protected by local users, as opposed to by domain users.
Duplicated SIDs are usually not a problem with Microsoft Windows systems, although other programs that detect SIDs might have problems with its security.
Microsoft used to provide Mark Russinovich's "NewSID" utility as a part of Sysinternals to change a machine SID. It was retired and removed from download on November 2, 2009. Russinovich's explanation is that neither him nor the Windows security team could think of any situation where duplicate SIDs could cause any problems at all, because machine SIDs are never responsible for gating any network access.
At present, the only supported mechanism for duplicating disks for Windows operating systems is through use of SysPrep, which generates new SIDs.