Glossary
Security Identifier (SID)
The unique value Windows uses to identify users, groups and computers, such as S-1-5-21-…-1001, found throughout registry, logs and file paths.
A Security Identifier (SID) is the value Windows uses internally to identify a security principal: a user, group, computer or service. Account names can change; the SID does not, and a SID is never reused for another account. That makes it the reliable key for attributing activity.
In string form a SID reads S-R-X-Y1-Y2-…-Yn: S, the revision (always 1), the identifier authority (5 for NT Authority) and a series of sub-authorities. For local and domain accounts, the middle sub-authorities form the machine or domain identifier (21-xxxxxxxxxx-yyyyyyyyyy-zzzzzzzzzz) and the last value is the relative identifier (RID):
- 500: the built-in Administrator account;
- 501: the Guest account;
- 1000 and above: accounts created by people or tools on a standalone system.
Well-known SIDs are identical on every system, for example S-1-5-18 (LocalSystem), S-1-5-19 (LocalService), S-1-5-20 (NetworkService) and S-1-5-32-544 (the built-in Administrators group).
SIDs show up throughout an investigation. The ProfileList key in the SOFTWARE hive maps each SID to a profile path, NTUSER.DAT is loaded under HKEY_USERS\<SID>, Recycle Bin folders are named by SID, and event logs record the SID of the acting account. The local account database is covered in SAM and user accounts. A new account with an unexpected RID, or an account with RID 500 being used interactively, is often worth a closer look.
Related artifacts
- $Secure:$SDS security descriptors$Secure:$SDS cheat sheet: NTFS security descriptor store, $SDH and $SII indexes, Security ID in $SI, file owner SID and ACLs, collection and MFTECmd.
- BAM / DAM (Background Activity Moderator)BAM and DAM cheat sheet: SYSTEM hive keys per Windows 10 build, per-user SIDs, last execution FILETIME, seven-day retention and investigation tips.
- DPAPI and Credential ManagerDPAPI and Credential Manager cheat sheet: master keys, Windows Vault, what secrets they hold, offline decryption requirements and credential-theft traces.
- Group Policy artifactsGroup Policy cheat sheet: SYSVOL policies, Registry.pol, GPP passwords, client-side history and event logs, and how attackers abuse GPO for mass deployment.
- Installed Programs (Uninstall Keys, MSI, AppX)Installed programs cheat sheet: Uninstall keys, MsiInstaller events 1033/11707, cached MSIs, AppX packages, winget logs and Amcache to date software installs.
- NTDS.dit and domain controllersNTDS.dit cheat sheet: the Active Directory database, what it proves, theft traces on a DC, and the Kerberos, NTLM and DCSync event IDs investigators need.
- Recycle BinRecycle Bin cheat sheet: $Recycle.Bin $I and $R files, $I version 1 vs 2, XP INFO2, deletion time, original path and size, emptying and Shift+Delete traces.
- SAM hive and user accountsSAM hive cheat sheet: local accounts, RIDs, last logon and password change times, logon counts, group membership, ProfileList, and account-related event IDs.
- SRUM (System Resource Usage Monitor)SRUM cheat sheet: SRUDB.dat tables and GUIDs, per-app network bytes and CPU time, hourly UTC records, 30 to 60 day retention and ESE repair steps.