Windows Security Identifier (SID)

Unique values of variable length used to identify a Trustee on Windows OS.

Interpretation

An SID is broken down in the following pattern: (SID)-(revision level)-(identifier-authority)-(subauthority1)-(subauthority2)-(etc)

With the components:

SID: Identifies the string as a SID.
Revision Level: To this date, this has never changed and has always been 1.
Identifier-authority: 48-bit string that identifies the authority (the computer or network) that created the SID.
Subauthority1: Variable number that identifies the user’s relation or group described by the SID to the authority that created it. It tells us in what order this authority created the user’s account.
Subauthority2: Identifies which computer (or domain) created the number.
Subauthority3: The RID that distinguishes one account from another. Tells us whether this user is a normal user, a guest, an administrator, or part of some other group.

A SID is used in access tokens to identify the user and the groups that the user belongs to.

Each account has a unique SID issued by an authority, like a Windows domain controller, and stored in a security database.
Each time a user logs on, the system retrieves the SID for the user from the database and places it in an access token for the user.
The SID in the access token is then used by the system to identify the user in all subsequent interactions with Windows security.

SIDs are used in Windows Security Descriptors to identify the owner of an object and primary group.

SIDs are used in Access Control Entry (ACE) to identify the trustee for whom the access is allowed, denied, or audited.