In the context of the Microsoft Windows NT line of operating systems , a Security Identifier ( SID ) is a unique, immutable identifier of a user, user group, or other security principal . A security principal has a single SID for life (in a given domain), and all properties of the principal, including its name, are associated with the SID. This design allows a principal to be renamed (for example, from "Jane Smith" to "Jane Jones") without affecting the security attributes of objects that refer to the principal.
38-467: Windows grants or denies access and privileges to resources based on access control lists (ACLs), which use SIDs to uniquely identify users and their group memberships. When a user logs into a computer, an access token is generated that contains user and group SIDs and user privilege level. When a user requests access to a resource, the access token is checked against the ACL to permit or deny particular action on
76-496: A host or other layer 3 , each with a list of hosts and/or networks permitted to use the service. Although it is additionally possible to configure access-control lists based on network domain names , this is a questionable idea because individual TCP , UDP , and ICMP headers do not contain domain names. Consequently, the device enforcing the access-control list must separately resolve names to numeric addresses. This presents an additional attack surface for an attacker who
114-496: A host or other layer 3 , each with a list of hosts and/or networks permitted to use the service. Although it is additionally possible to configure access-control lists based on network domain names , this is a questionable idea because individual TCP , UDP , and ICMP headers do not contain domain names. Consequently, the device enforcing the access-control list must separately resolve names to numeric addresses. This presents an additional attack surface for an attacker who
152-426: A Workgroup of computers running Windows NT/2K/XP, it is possible for a user to have unexpected access to shared files or files stored on a removable storage. This can be prevented by setting access control lists on a susceptible file, such that the effective permissions are determined by the user SID. If this user SID is duplicated on another computer, a user of a second computer having the same SID could have access to
190-479: A capability SID, you cannot use the UI to add it back. 14 - SChannel 21 - Digest S-1-5-80-0 corresponds to "NT SERVICE\ALL SERVICES" S-1-5-83-0 is the group ID for "NT VIRTUAL MACHINE\Virtual Machines" Owner SID for GUID <gid>: S-1-5-88-2-<gid> File Mode: S-1-5-88-3-<mode> Everyone: S-1-5-88-4 Virtual Accounts are defined for a fixed set of class names, but the account name isn't defined. There are
228-484: A computer enters a domain. This SID is similar to the machine SID. As a result, there are typically no significant problems with duplicate SIDs when the computers are members of a domain, especially if local user accounts are not used. If local user accounts are used, there is a potential security issue similar to the one described above, but the issue is limited to the files and resources protected by local users, as opposed to by domain users. Duplicated SIDs are usually not
266-494: A nearly infinite number of accounts available within a Virtual Account. The names work like "Account Class\Account Name" so "AppPoolIdentity\Default App Pool". The SID is based on a SHA-1 hash of the lower-case name. Virtual Accounts can each be given permissions separately as each maps to a distinct SID. This prevents the "cross-sharing permissions" problem where each service is assigned to the same NT AUTHORITY class (such as "NT AUTHORITY\Network Service"). The machine SID (S-1-5-21)
304-452: A new random SID for the computer. NewSID's generation takes great pains to create a truly random 96-bit value, which replaces the 96-bits of the 3 subauthority values that make up a computer SID. The machine SID subauthority format is used for domain SIDs too. A machine is considered its own local domain in this case. The machine SID is stored in a raw-bytes form in the registry. To convert it into
342-413: A particular object. SIDs are useful for troubleshooting issues with security audits, Windows Server and domain migrations. The format of a SID can be illustrated using the following example: "S-1-5-21-3623811015-3361044348-30300820-1013": Known identifier authority values are: Windows Server 2012 By design, a capability SID does not resolve to a friendly name. The most commonly used capability SID
380-597: A problem with Microsoft Windows systems, although other programs that detect SIDs might have problems with its security. Microsoft used to provide Mark Russinovich 's "NewSID" utility as a part of Sysinternals to change a machine SID. It was retired and removed from download on November 2, 2009. Russinovich's explanation is that neither him nor the Windows security team could think of any situation where duplicate SIDs could cause any problems at all, because machine SIDs are never responsible for gating any network access. At present,
418-553: A superset of both NT ACLs and POSIX draft ACLs. Samba supports saving the NT ACLs of SMB-shared files in many ways, one of which is as NFSv4-encoded ACLs. Microsoft 's Active Directory service implements an LDAP server that store and disseminate configuration information about users and computers in a domain. Active Directory extends the LDAP specification by adding the same type of access-control list mechanism as Windows NT uses for
SECTION 10
#1732858173328456-456: A superset of both NT ACLs and POSIX draft ACLs. Samba supports saving the NT ACLs of SMB-shared files in many ways, one of which is as NFSv4-encoded ACLs. Microsoft 's Active Directory service implements an LDAP server that store and disseminate configuration information about users and computers in a domain. Active Directory extends the LDAP specification by adding the same type of access-control list mechanism as Windows NT uses for
494-489: A typical ACL specifies a subject and an operation. For instance, Many kinds of operating systems implement ACLs or have a historical implementation; the first implementation of ACLs was in the filesystem of Multics in 1965. A filesystem ACL is a data structure (usually a table) containing entries that specify individual user or group rights to specific system objects such as programs, processes , or files. These entries are known as access-control entries (ACEs) in
532-489: A typical ACL specifies a subject and an operation. For instance, Many kinds of operating systems implement ACLs or have a historical implementation; the first implementation of ACLs was in the filesystem of Multics in 1965. A filesystem ACL is a data structure (usually a table) containing entries that specify individual user or group rights to specific system objects such as programs, processes , or files. These entries are known as access-control entries (ACEs) in
570-687: Is seeking to compromise security of the system which the access-control list is protecting. Both individual servers and routers can have network ACLs. Access-control lists can generally be configured to control both inbound and outbound traffic, and in this context they are similar to firewalls . Like firewalls, ACLs could be subject to security regulations and standards such as PCI DSS . ACL algorithms have been ported to SQL and to relational database systems . Many "modern" (2000s and 2010s) SQL -based systems, like enterprise resource planning and content management systems, have used ACL models in their administration modules. The main alternative to
608-687: Is seeking to compromise security of the system which the access-control list is protecting. Both individual servers and routers can have network ACLs. Access-control lists can generally be configured to control both inbound and outbound traffic, and in this context they are similar to firewalls . Like firewalls, ACLs could be subject to security regulations and standards such as PCI DSS . ACL algorithms have been ported to SQL and to relational database systems . Many "modern" (2000s and 2010s) SQL -based systems, like enterprise resource planning and content management systems, have used ACL models in their administration modules. The main alternative to
646-605: Is stored in the SECURITY registry hive located at SECURITY\SAM\Domains\Account , this key has two values F and V . The V value is a binary value that has the computer SID embedded within it at the end of its data (last 96 bits). (Some sources state that it is stored in the SAM hive instead.) A backup is located at SECURITY\Policy\PolAcDmS\@ . NewSID ensures that this SID is in a standard NT 4.0 format (3 32-bit subauthorities preceded by three 32-bit authority fields). Next, NewSID generates
684-483: Is the following: S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681 Identifying a capability SID: Per Microsoft Support: Important - DO NOT DELETE capability SIDS from either the Registry or file system permissions. Removing a capability SID from file system permissions or registry permissions may cause a feature or application to function incorrectly. After you remove
722-462: The "dnscache" service: Therefore, the "dnscache" service can be referred to as either NT SERVICE\dnscache , or the more cumbersome S-1-5-80-859482183-879914841-863379149-1145462774-2388618682 ; they are synonyms. Also, note that since a Service SID is determined exclusively by the service name, the value of the SID for a given service is always the same across all machines wherever the service runs. In
760-572: The "unrestricted" SID-type property will have a service-specific SID added to the access token of the service host process. The purpose of Service SIDs is to allow permissions for a single service to be managed without necessitating the creation of service accounts, an administrative overhead. Each service SID is a local, machine-level SID generated from the service name using the following formula: S-1-5-80-{SHA-1(service name in upper case encoded as UTF-16 )} The sc.exe command can be used to generate this special SID value; for example, given
798-523: The ACL model is the role-based access-control (RBAC) model. A "minimal RBAC model", RBACm , can be compared with an ACL mechanism, ACLg , where only groups are permitted as entries in the ACL. Barkley (1997) showed that RBACm and ACLg are equivalent. In modern SQL implementations, ACLs also manage groups and inheritance in a hierarchy of groups. So "modern ACLs" can express all that RBAC express and are notably powerful (compared to "old ACLs") in their ability to express access-control policy in terms of
SECTION 20
#1732858173328836-523: The ACL model is the role-based access-control (RBAC) model. A "minimal RBAC model", RBACm , can be compared with an ACL mechanism, ACLg , where only groups are permitted as entries in the ACL. Barkley (1997) showed that RBACm and ACLg are equivalent. In modern SQL implementations, ACLs also manage groups and inheritance in a hierarchy of groups. So "modern ACLs" can express all that RBAC express and are notably powerful (compared to "old ACLs") in their ability to express access-control policy in terms of
874-507: The ACL on an object. One of the first operating systems to provide filesystem ACLs was Multics . PRIMOS featured ACLs at least as early as 1984. In the 1990s the ACL and RBAC models were extensively tested and used to administer file permissions. POSIX 1003.1e/1003.2c working group made an effort to standardize ACLs, resulting in what is now known as "POSIX.1e ACL" or simply "POSIX ACL". The POSIX.1e/POSIX.2c drafts were withdrawn in 1997 due to participants losing interest for funding
912-507: The ACL on an object. One of the first operating systems to provide filesystem ACLs was Multics . PRIMOS featured ACLs at least as early as 1984. In the 1990s the ACL and RBAC models were extensively tested and used to administer file permissions. POSIX 1003.1e/1003.2c working group made an effort to standardize ACLs, resulting in what is now known as "POSIX.1e ACL" or simply "POSIX ACL". The POSIX.1e/POSIX.2c drafts were withdrawn in 1997 due to participants losing interest for funding
950-469: The Microsoft Windows NT , OpenVMS , and Unix-like operating systems such as Linux , macOS , and Solaris . Each accessible object contains an identifier to its ACL. The privileges or permissions determine specific access rights, such as whether a user can read from, write to, or execute an object. In some implementations, an ACE can control whether or not a user, or group of users, may alter
988-406: The Microsoft Windows NT , OpenVMS , and Unix-like operating systems such as Linux , macOS , and Solaris . Each accessible object contains an identifier to its ACL. The privileges or permissions determine specific access rights, such as whether a user can read from, write to, or execute an object. In some implementations, an ACE can control whether or not a user, or group of users, may alter
1026-569: The NFSv4 standard. There are two experimental implementations of NFSv4 ACLs for Linux: NFSv4 ACLs support for Ext3 filesystem and the more recent Richacls , which brings NFSv4 ACLs support for Ext4 filesystem. As with POSIX ACLs, NFSv4 ACLs are usually stored as extended attributes on Unix-like systems. NFSv4 ACLs are organized nearly identically to the Windows ;NT ACLs used in NTFS . NFSv4.1 ACLs are
1064-420: The NFSv4 standard. There are two experimental implementations of NFSv4 ACLs for Linux: NFSv4 ACLs support for Ext3 filesystem and the more recent Richacls , which brings NFSv4 ACLs support for Ext4 filesystem. As with POSIX ACLs, NFSv4 ACLs are usually stored as extended attributes on Unix-like systems. NFSv4 ACLs are organized nearly identically to the Windows NT ACLs used in NTFS . NFSv4.1 ACLs are
1102-474: The NTFS filesystem. Windows 2000 then extended the syntax for access-control entries such that they could not only grant or deny access to entire LDAP objects, but also to individual attributes within these objects. On some types of proprietary computer hardware (in particular, routers and switches ), an access-control list provides rules that are applied to port numbers or IP addresses that are available on
1140-427: The NTFS filesystem. Windows 2000 then extended the syntax for access-control entries such that they could not only grant or deny access to entire LDAP objects, but also to individual attributes within these objects. On some types of proprietary computer hardware (in particular, routers and switches ), an access-control list provides rules that are applied to port numbers or IP addresses that are available on
1178-532: The extended attributes of a file on these systems. NFSv4 ACLs are much more powerful than POSIX draft ACLs. Unlike draft POSIX ACLs, NFSv4 ACLs are defined by an actually published standard, as part of the Network File System . NFSv4 ACLs are supported by many Unix and Unix-like operating systems. Examples include AIX , FreeBSD , Mac OS X beginning with version 10.4 (" Tiger "), or Solaris with ZFS filesystem, support NFSv4 ACLs, which are part of
Security Identifier - Misplaced Pages Continue
1216-471: The extended attributes of a file on these systems. NFSv4 ACLs are much more powerful than POSIX draft ACLs. Unlike draft POSIX ACLs, NFSv4 ACLs are defined by an actually published standard, as part of the Network File System . NFSv4 ACLs are supported by many Unix and Unix-like operating systems. Examples include AIX , FreeBSD , Mac OS X beginning with version 10.4 (" Tiger "), or Solaris with ZFS filesystem, support NFSv4 ACLs, which are part of
1254-403: The files that the user of a first computer has protected. This can often happen when machine SIDs are duplicated by a disk clone, common for pirate copies. The user SIDs are built based on the machine SID and a sequential relative ID. When the computers are joined into a domain (Active Directory or NT domain for instance), each computer is provided a unique Domain SID which is recomputed each time
1292-486: The more common numeric form, one interprets it as three little endian 32-bit integers, converts them to decimal, and add hyphens between them. The machine SID is also used by some free-trial programs, such as Start8 , to identify the computer so that it cannot restart the trial. Service SIDs are a feature of service isolation , a security feature introduced in Windows Vista and Windows Server 2008 . Any service with
1330-468: The only supported mechanism for duplicating disks for Windows operating systems is through use of SysPrep , which generates new SIDs. Access control list In computer security , an access-control list ( ACL ) is a list of permissions associated with a system resource (object or facility). An ACL specifies which users or system processes are granted access to resources, as well as what operations are allowed on given resources. Each entry in
1368-575: The project and turning to more powerful alternatives such as NFSv4 ACL. As of December 2019 , no live sources of the draft could be found on the Internet, but it can still be found in the Internet Archive . Most of the Unix and Unix-like operating systems (e.g. Linux since 2.5.46 or November 2002, FreeBSD , or Solaris ) support POSIX.1e ACLs (not necessarily draft 17). ACLs are usually stored in
1406-419: The project and turning to more powerful alternatives such as NFSv4 ACL. As of December 2019 , no live sources of the draft could be found on the Internet, but it can still be found in the Internet Archive . Most of the Unix and Unix-like operating systems (e.g. Linux since 2.5.46 or November 2002, FreeBSD , or Solaris ) support POSIX.1e ACLs (not necessarily draft 17). ACLs are usually stored in
1444-481: The way in which administrators view organizations. For data interchange, and for "high-level comparisons", ACL data can be translated to XACML . Access control list In computer security , an access-control list ( ACL ) is a list of permissions associated with a system resource (object or facility). An ACL specifies which users or system processes are granted access to resources, as well as what operations are allowed on given resources. Each entry in
#327672