Security Identifier (SID) is a unique,immutable identifier of a user account, user group, or othersecurity principal in theWindows NT family ofoperating systems. A security principal has a single SID for life (in a givenWindows domain), and all properties of the principal, including its name, are associated with the SID. This design allows a principal to be renamed (for example, from "Jane Smith" to "Jane Jones") without affecting the security attributes of objects that refer to the principal.
Windows grants privileges and access to resources based onaccess control lists (ACLs). Each entry on the list defines one SID and a set of permissions for that SID. When a user logs into aPC, Windows generates anaccess token that contains the user SID, the group SIDs to which the user account belongs, and the user privilege level. When a user requests access to a resource, its ACL is checked against the user's access token to permit or deny particular action on a particular object.
The human-readable representation of a SID is a string that starts with "S-" and consists of several dash-separated numbers. For example, "S-1-5-21-3623811015-3361044348-30300820-1013" could be a user account's SID. The following table explains the components of this example SID.
| Component | Example | Explanation |
|---|---|---|
| Header | S | Identifies the string as a SID |
| Revision level | 1 | The version number of the SID specification. As of 2025[update], "1" is the only valid number. |
| Authority | 5 | See below |
| Subauthorities | 21-3623811015-3361044348-30300820 | In this example, "21" indicates a "domain" subauthority. The following 96-bit ID is a domain identifier. |
| Relative ID (RID) | 1013 | Uniquely identifies the principal within its subauthority group. In the context of domain accounts (which is the focus of our example), RIDs greater than 1000 indicate an admin-defined principal (as opposed to a predefined, built-in, or special-purpose generic principal). |
Originally, SIDs were supposed to allow arbitrarily deep nesting, with each level allowed to create sub-authorities underneath itself. However, that goal was abandoned early in Windows NT development, when it was decided that it would be too unmanageable in practice; by then, however, the SID format had already been finalized and was in heavy use in the Windows code.[1]
Identifier authorities are formally defined as six-byte (48-bit) quantities. The identifier authority is expressed in decimal if its value is less than 232, otherwise inhexadecimal.[2][3] However, while this is the behavior formally defined byMicrosoft, and implemented by the relevant Windows APIs (e.g.RtlConvertSidToUnicodeString),[3] hexadecimal identifier authorities appear to have never been used in practice. All known values fit in the least significant byte, and the other 5 bytes are always zero. Identifier authorities are stored inbig-endian format, even on little-endianCPU architectures.
| Authority | Formal name | First introduced | Notes |
|---|---|---|---|
| 0 | Null Authority | e.g., "Nobody" (S-1-0-0) | |
| 1 | World Authority | e.g., well-known groups such as "Everyone". (S-1-1-0) | |
| 2 | Local Authority | e.g., flag SIDs like "CONSOLE LOGON" | |
| 3 | Creator Authority | ||
| 4 | Non-unique Authority | ||
| 5 | NT Authority | Managed by the NT security subsystem. There are many sub-authorities such as "BUILTIN" and everyActive DirectoryDomain | |
| 6[6][7] | Site Server Authority | Windows XP | |
| 7[6][7] | Internet Site Authority | Windows XP | |
| 8[6][7][8] | Exchange Authority | Windows XP | |
| 9[7][9][10] | Resource Manager Authority | Windows Server 2003 | |
| 10[6] | Passport Authority | ||
| 11[11] | Microsoft Account Authority | Windows 8 | |
| 12 | Azure Active Directory | Windows 10 | |
| 15[12][13][14] | App Package Authority (Capability SIDs) | Windows Server 2012 | All capability SIDs begin at S-1-15-3. By design, a capability SID does not resolve to a friendly name. The most commonly used capability SID is S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681 |
| 16[15] | Mandatory Label Authority | Windows Vista | Used as part ofMandatory Integrity Control |
| 17[16] | Scoped Policy ID Authority | ||
| 18[16] | Authentication Authority | ||
| 19[17] | Process Trust Authority |
| Decimal | Name | First introduced | Format and purpose |
|---|---|---|---|
| 1 | Dial-up Login | S-1-5-1. | |
| 2 | Network Login | S-1-5-2. | |
| 3 | Batch Login | S-1-5-3. | |
| 4 | Interactive Login | S-1-5-4. | |
| 6 | Service Login | S-1-5-6. | |
| 7 | Anonymous Login | S-1-5-7. | |
| 8[5] | Proxy Login | Windows Server 2003 | S-1-5-8 is the SID of the "SECURITY_NT_AUTHORITY" proxy.[5] |
| 9 | Enterprise Domain Controllers | S-1-5-9. | |
| 10 | Principal Self | S-1-5-10. | |
| 11 | Authenticated Users | Windows NT 4.0 | S-1-5-11. |
| 12 | Restricted Code | Windows 2000 | S-1-5-12. |
| 13 | Terminal Server User | S-1-5-13. | |
| 14 | Remote Interactive Login | S-1-5-14. | |
| 15 | This Organisation | S-1-5-15. | |
| 17 | IUSR | S-1-5-17. | |
| 18 | LocalSystem | Windows NT 3.1 | S-1-5-18 is the SID of the LocalSystem account on all Windows machines. |
| 19 | LocalService | Windows XP | S-1-5-19 is the SID of the LocalService account on all Windows machines. |
| 20 | NetworkService | Windows XP | S-1-5-20 is the SID of the NetworkService account on all Windows machines. |
| 21 | Domain | Windows NT 3.1 | S-1-5-21-<Domain ID>-<RID>, where<Domain ID> is in the form of<32-bit>-<32-bit>-<32-bit>. Seebelow for details. |
| 32 | Builtin | Windows NT 3.1 | S-1-5-32-<RID>. Example: S-1-5-32-544 (the built-in Administrators group).The resulting SID pertains a predefined, special-purpose user group, and is valid on all Windows machines. RID could only be one the predefined ones. |
| 33 | Write Restricted Code | Windows 7 | S-1-5-33. |
| 64 | Authentication | S-1-5-64-<RID>, where<RID> is one of the following:
| |
| 80 | NT Service | Windows Vista | S-1-5-80-<RID>, where<RID> is a service identifier. "0" (zero) is reserved for the ALL SERVICES group (hence, S-1-5-80-0'sfully qualified name is NT SERVICE\ALL SERVICES). |
| 82 | IIS AppPool | Windows 7 | |
| 83-0 | Virtual Machines | Windows 7 | S-1-5-83-0 is the SID of the "NT VIRTUAL MACHINE\Virtual Machines" group, which maintains a list of all Hyper-V virtual machines. |
| 83-1 | Virtual Machine | Windows 7 | S-1-5-83-1-<ID1>-<ID2>-<ID3>-<ID4>.The resulting SID pertains a Hyper-V virtual machine. |
| 90[5] | Windows Manager | Windows 7 | S-1-5-90-0 is the SID of the "Windows Manager Group", a built-in group that maintains all virtual accounts of theDesktop Windows Manager (DWM).
|
| 96 | User-Mode Driver Framework | Windows 7 | S-1-5-96-0-<RID>, where<RID> is a number, is the SID format of aUser-Mode Driver Framework (UMDF) virtual account. For example,S-1-5-96-0-1 pertains UMDF-1. The User-mode Font Driver Host (fontdrvhost.exe) runs in the context of a UMDF account. |
| 113 | Local Account | S-1-5-113. | |
| 114 | Local Account & Administrator | S-1-5-114. | |
| 1000 | Other Organisation | S-1-5-1000. |
SIDs that start with "S-1-5-21" are noticeably longer than most other SIDs (with the notable exception of service SIDs). Their general format is:S-1-5-21-<Domain ID>-<RID>, where<Domain ID> is in the form of<32-bit>-<32-bit>-<32-bit>.
The Domain ID uniquely identifies aWindows domain. The RID specifies a principal (user account, group account, or computer account) within that domain.
If the RID portion is greater than 1000, the resulting SID pertains an admin-defined user account, user group, or computer account, e.g., S-1-5-21-3361044348-303008203623811015-1001. The name of this account could be anything, e.g.,Domain.local\JaneDoe.
If the RID portion is smaller than 1000, the resulting SID pertains a predefined (built-in) user account or user group. For example, RID 500 identifies the controversial "Administrator" user account while RID 512 pertains the "Domain Admins" group.
Machine SIDs are variety of domain SIDs (S-1-5-21) with a 96-bit domain ID (a machine is considered its own local domain) but no RID. Their general format is:S-1-5-21-<Machine ID>, where<Machine ID> is in the form of<32-bit>-<32-bit>-<32-bit>.
The machine SID is stored in the SECURITY hive of theWindows Registry, more specifically atHKEY_LOCAL_MACHINE\SECURITY\SAM\Domains\Account. This key has two values: F and V. The latter is a raw binary value that has the machine SID embedded within it at the end of its data (last 96 bits).[19] (Some sources[example needed] state that it is stored in the SAM hive instead.)A backup is located atSECURITY\Policy\PolAcDmS\@.[citation needed]
NewSID ensures that this SID is in a standard NT 4.0 format (3 32-bit subauthorities preceded by three 32-bit authority fields). Next, NewSID generates a new random SID for the computer. NewSID's generation takes great pains to create a truly random 96-bit value, which replaces the 96-bits of the 3 subauthority values that make up a computer SID.
— NewSID readme[20]
The machine SID is stored in a raw-bytes form in the registry. To convert it into the more common numeric form, one interprets it as three,little endian, 32-bit integers, converts them to decimal, and add hyphens between them.
| Raw form (hexadecimal representation) | 2E,43,AC,40,C0,85,38,5D,07,E5,3B,2B |
|---|---|
| Split the bytes into 3 groups of four octets | 2E,43,AC,40 - C0,85,38,5D - 07,E5,3B,2B |
| Reverse the order of bytes in each group | 40,AC,43,2E - 5D,38,85,C0 - 2B,3B,E5,07 |
| Convert each group into decimal | 1085031214 - 1563985344 - 725345543 |
| Add the machine SID prefix | S-1-5-21-1085031214-1563985344-725345543 |
Service SIDs are a feature ofservice isolation, introduced inWindows Vista andWindows Server 2008.[21] Any service with the "unrestricted" SID-type property will have a service-specific SID added to the access token of the service host process, allowing permissions for a single service to be managed without necessitating the creation of service accounts.
Each service SID is a local, machine-level SID that has the general form ofS-1-5-80-<Service ID>. To generate<Service ID>, Windows copies the service name (inUTF-16 encoding), converts all characters to uppercase, and calculates theSHA-1 digest of said uppercase name. This digest becomes the<Service ID>. Thesc.execommand can be used to generate this special SID value; for example, given the "dnscache" service:
C:\>sc queryNAME: dnscacheSERVICE SID: S-1-5-80-859482183-879914841-863379149-1145462774-2388618682
Therefore, the "dnscache" service can be referred to as eitherNT SERVICE\dnscache orS-1-5-80-859482183-879914841-863379149-1145462774-2388618682. Since a Service SID is determined exclusively by the service name, the value of the SID for a given service is always the same across all machines wherever the service runs.
A common method of mass-producing Windows PCs is to install Windows on a template machine, and duplicate its disk sector by sector to other identical machines. As a result, these mass-produced machines are identical in every respect, including their SIDs.[20]
Microsoft engineerMark Russinovich is the creator of autility called NewSID, the purpose of which is to solve "The SID Duplication Problem."[20] Microsoft has retired the utility on November 2, 2009, because, Mark and the Windows security team have concluded that duplicate SIDs do not pose any problem whatsoever.[22]