|
Security Identifiers (SIDs)
A security identifier (SID) is a unique value of variable length used to
identify a user or group. The SID assigned to a user when he or she logs on becomes
part of the access token that accompanies any process begun by that user.
Except for the logon SID, an SID is always unique. When it has been used to identify
a user or group, it cannot be used again, at any time, to identify another
user or group.
SIDs identify several separate elements. These include the owner and group in
security descriptors, the recipient of the access being granted by
access-control entries (ACEs), and the user, as well as groups of which the user is a
member in access tokens.
An SID also contains the following information.
- A 48-bit identifier authority value
- A revision level
- A variable number of subauthority values (relative identifiers)
The identifier authority value actually contains two values and is the most
important piece of information in an SID. It contains a value identifying the
agency that issued the SID, usually representing a Microsoft® Server™ domain, and a 32-bit relative identifier (RID) value, to uniquely identify
the user or group in that agency. Joining these values ensures that no two SIDs
will be the same, even if two different SID-issuing authorities issue the same
RID. Each SID-issuing authority issues a given RID only once.
A standardized shorthand notation for SIDs makes it simpler to visualize their
components:
S-R-I-S-S...
In the notation shown above, S identifies the series of digits as an SID, R is the revision level, I is the identifier-authority value, and S is the subauthority value. An SID could be written in this notation as
follows:
S-1 413886
In this example, the SID has a revision level of 1, an identifier-authority
value of 4138, and one subauthority value of 86.
An application is never required to manipulate an SID directly. The following
Win32 functions provide all the functionality required to work with SIDs.
Function
| Description
| AllocateAndInitializeSid
| Allocates and initializes an SID with the specified number of subauthorities.
| CopySid
| Copies a source SID to a buffer.
| EqualPrefixSid
| Tests two SID prefix values for equality. An SID prefix is the entire SID
except for the last subauthority value.
| EqualSid
| Tests two SIDs for equality. They must match exactly to be considered equal.
| FreeSid
| Frees an SID previously allocated by using the AllocateAndInitializeSid function.
| GetLengthSid
| Retrieves the length of an SID.
| GetSidIdentifierAuthority
| Retrieves a pointer to an SID's identifier authority.
| GetSidLengthRequired
| Retrieves the size of the buffer required to store an SID with a specified
number of subauthorities.
| GetSidSubAuthority
| Retrieves a pointer to a specified subauthority in an SID.
| GetSidSubAuthorityCount
| Retrieves the number of subauthorities in an SID.
| InitializeSid
| Initializes an SID structure.
| IsValidSid
| Tests the validity of an SID by verifying that the revision number is within a
known range and that the number of subauthorities is less than the maximum.
| LookupAccountName
| Retrieves the SID corresponding to a specified account name. Use the GetUserName function to retrieve the user name for the current thread.
| LookupAccountSid
| Retrieves the account name corresponding to a specified SID.
|
Some identifier authorities are predefined, as shown in the following table.
Identifier authority
| SID Value
| SECURITY_NULL_SID_AUTHORITY
| 0
| SECURITY_WORLD_SID_AUTHORITY
| -
| SECURITY_LOCAL_SID_AUTHORITY
| -
| SECURITY_CREATOR_SID_AUTHORITY
| -
| SECURITY_NT_AUTHORITY
| 5
|
The following RID values are also defined.
Relative identifier authority
| Value
| Superior authority
| SECURITY_NULL_RID
| 0
| S-10
| SECURITY_WORLD_RID
| 0
| S-11
| SECURITY_LOCAL_RID
| 0
| S-12
| SECURITY_CREATOR_OWNER_RID
| 0
| S-13
| SECURITY_CREATOR_GROUP_RID
| -
| S-13
|
An application can combine an identifier authority and one of these RID values
to create an SID that is meaningful on all installations. For example, S-110 (SECURITY_WORLD_SID_AUTHORITY and SECURITY_WORLD_RID) always identifies the
special group representing all users. These security identifiers are universal well-known SIDs. A universal well-known SID is meaningful on all secure systems using this
security model, including systems not running Windows NT. The AllocateAndInitializeSid function provides a simple method of combining an identifier authority and an
RID.
The following are some universal well-known SIDs.
Universal well-known SID
| Value
| Identifies
| Null SID
| (S-100)
| A group with no members. This is often used when an SID value is not known.
| World
| (S-110)
| A group that includes all users.
| Local
| (S-120)
| Users who log on to terminals locally (physically) connected to the system.
| Creator Owner ID
| (S-130)
| A security identifier to be replaced by the security identifier of the user
who created a new object. This SID is used in inheritable ACLs.
| Creator Group ID
| (S-131)
| Identifies a security identifier to be replaced by the primary-group SID of
the user who created a new object. Use this SID in inheritable ACLs.
|
Another predefined identifier authority is SECURITY_NT_AUTHORITY (S-15). This identifier authority produces SIDs that are not universal but are
meaningful only on Windows NT installations. An application can use the following
RID values with SECURITY_NT_AUTHORITY to create well-known SIDs.
SECURITY_DIALUP_RID (S-151)
|
|
| Users who log on to terminals using a dialup modem. This is a group identifier.
|
SECURITY_NETWORK_RID (S-152)
|
|
| Users who log on across a network. This is a group identifier.
|
SECURITY_BATCH_RID (S-153)
|
|
| Users who log on using a batch queue facility. This is a group identifier.
|
SECURITY_INTERACTIVE_RID (S-154)
|
|
| Users who log on for interactive operation. This is a group identifier.
|
SECURITY_LOGON_IDS_RID (S-155-X-Y)
|
|
| A logon session. This is used to ensure that only processes in a given logon
session can gain access to the window-station objects for that session. The X and Y values for these SIDs are different for each logon session. The value
SECURITY_LOGON_IDS_RID_COUNT is the number of RIDs in this identifier (5-X-Y).
|
SECURITY_SERVICE_RID (S-156)
|
|
| An account authorized to perform security services.
|
SECURITY_LOCAL_SYSTEM_RID (S-150x12)
|
|
| The user account used by the operating system.
|
SECURITY_BUILTIN_DOMAIN_RID (S-150x20)
|
|
| The built-in system domain.
|
The following RIDs are relative to each domain.
RID
| Identifies
| DOMAIN_USER_RID_ADMIN
| The administrative user account in a domain.
| DOMAIN_USER_RID_GUEST
| The guest-user account in a domain. This account can be logged onto
automatically by users who do not have an account.
| DOMAIN_GROUP_RID_ADMINS
| The domain administrator's group. This account exists only on systems running
Microsoft® LAN Manager for Windows NT®, not Windows NT systems.
| DOMAIN_GROUP_RID_USERS
| A group containing all user accounts in a domain. All users are automatically
added to this group.
|
An alias is a local group and is similar to a global group, but it can contain
members from other domains. Its members can be users or other groups. Some
domain-relative RIDs, such as the following, can be used to form well-known SIDs
used as local groups.
RID
| Identifies
| DOMAIN_ALIAS_RID_ADMINS
| A local group used for administration of the domain.
| DOMAIN_ALIAS_RID_USERS
| A local group representing all users in the domain.
| DOMAIN_ALIAS_RID_GUESTS
| A local group representing guests of the domain.
| DOMAIN_ALIAS_RID_POWER_USERS
| A local group used to represent a user or set of users that expect to treat a
system as if it were their personal computer rather than a multiuser
workstation.
| DOMAIN_ALIAS_RID_ACCOUNT_OPS
| A local group existing only on systems running Microsoft LAN Manager for
Windows NT. This local group permits control over non-administrator accounts.
| DOMAIN_ALIAS_RID_SYSTEM_OPS
| A local group existing only on systems running Microsoft LAN Manager for
Windows NT. This local group performs system administrative functions, not including
security functions. It establishes network shares, controls printers, unlocks
workstations, and performs other operations.
| DOMAIN_ALIAS_RID_PRINT_OPS
| A local group existing only on systems running Microsoft LAN Manager for
Windows NT. This local group controls printers and print queues.
| DOMAIN_ALIAS_RID_BACKUP_OPS
| A local group used for controlling assignment of file backup-and-restore
privileges.
| DOMAIN_ALIAS_RID_REPLICATOR
| A local group responsible for copying security databases from the primary
domain controller to the backup domain controllers.
|
| Last news from Greatis Software |
 |
|
Nostalgia .Net |
|
.Net is powerful, but not all-powerful, so sometimes we need to use Win32 API for our .Net applications. It's simple enough with Platform Invoke if you have Win32 skill, but we do not always have time to dig the ancient documentation, declare the special types that are compatible with Win32, find the values of the Win32's constants and so on. Nostalgia .Net offers several simple-to-use classes, and components that will allow you to forget about the headache of Win32 and just use the power of Win32 in your application the same way as you use the native. Net classes. More » |
| Recommended software for developers |
 |
|
Ultimate Pack |
|
Component pack for Delphi and C++ Builder that contains runtime form designer, runtime object inspector, print suite and much more for the very special price. More » |
 |
|
Form Designer .Net |
|
Unique runtime form design solution that allows to edit any form in .Net WinForms application at runtime with full source codes for only 300 euro! More » |
 |
|
Print Suite .Net |
|
Print Suite .Net is a set of components for easy printing texts, images and grids from your WinForms applications. Full C# source codes are available More » |
 |
|
Gradient Controls .Net |
|
Gradient Controls .Net offers controls with gradient background feature. Labels, panels and so on... Full C# source codes are available More » |
 |
|
Greatis iGrid |
|
iGrid plots drawing grid right over your desktop, so you can use it everywhere, with any drawing application without any special plugins for different graphic editors. More » |
All the contacts and projectsDmitry Vasiliev (just.dmitry)
Related LinksSoftware for Visual Studio .NET developers
Software for Delphi and C++ Builder developers
Software for Visual Basic 6 developers
Delphi Tips&Tricks
MegaDetailed.NET More Online Helps Win32 Programmer's Reference
Win32 Multimedia Programmer's Reference
OLE Programmer's Reference
Microsoft Windows Pen API Programmer's Reference
Microsoft Windows Sockets 2 Reference
Microsoft Windows Telephony API (TAPI) Programmer's Reference
Unix Manual Pages
|
