Section 4: Security Identifiers (SIDs)

The Big Picture: Name vs ID Number

You have a name, such as "Sam Lee". But a bank does not trust names, because many people share one and names can change after marriage. The bank uses an account number that is unique and never reused.

Windows works the same way. You see user names like Harshil, but inside, Windows tracks every user and group by a SID: a long, unique ID number.

What it is: A SID (Security Identifier) is a unique value that identifies a user, a group, or a computer (anything that can be given permissions). Permissions and tokens use SIDs, not names.

4.1 SID Structure

A SID is written as a string of numbers separated by dashes. Here is a typical user SID:

S-1-5-21-3623811015-3361044348-30300820-1001
│ │ │  │  └─────────────┬─────────────┘ └─┬─┘
│ │ │  │                │                 └─ RID: the user (1001)
│ │ │  │                └─ Domain or machine ID (3 numbers)
│ │ │  └─ Sub-authority 21: "ordinary accounts of a domain/computer"
│ │ └─ Identifier authority 5: NT Authority (Windows itself)
│ └─ Revision: version of the SID format (always 1)
└─ "S" means this is a SID

The RID tells you a lot:

Because the machine ID is random, two PCs never produce the same SID by accident. This is why you cannot just copy an installed Windows to another PC and keep both on the same network without preparing it first (a tool called Sysprep exists for this job).

How to see your own SID: open Command Prompt and type whoami /user. You will see your name and the SID side by side.

4.2 Well-Known SIDs (Everyone, SYSTEM, Administrators)

What it is: A few SIDs are the same on every Windows PC in the world. They are called well-known SIDs. They stand for special groups and built-in identities.

Notice S-1-5-32-544: the part 32 means "built-in group of this PC", and 544 is the group number. It is the same on every PC, so an administrator's token on any machine carries it.

Everyone vs Authenticated Users. These two sound the same, but are not. Authenticated Users means "has signed in with a valid account". Everyone is wider. Hedge: in modern Windows, anonymous visitors are not normally part of Everyone, but permissions use Authenticated Users when the writer wants to be sure.

Why SYSTEM matters. Most Windows services run as SYSTEM. In Task Manager's Details tab, programs such as winlogon.exe and lsass.exe show SYSTEM as the user name. If something unexpected runs as SYSTEM, it deserves a careful look.

4.3 SID vs Username (SIDs Are the Permanent Identity)

What it is: The user name is a friendly label. The SID is the real identity. Windows stores the SID in permission lists and tokens, and only looks up the name when it needs to show it to a human.

Test it with a thought experiment.

Today:   user "Alice"  has SID ...-1004
         folder D:\Photos allows SID ...-1004

You rename "Alice" to "Alicia".   SID stays ...-1004.
         Folder still allows her. Everything keeps working.

You delete "Alicia" and create a NEW account named "Alice".
         New SID is ...-1005.
         The folder's permission entry for ...-1004 now points to nobody.
         The new Alice gets no access. (Even though the name looks the same!)

That is the key lesson: a deleted and re-created account is a different person, because its SID is new. SIDs are never reused on the same machine or domain, which prevents a stranger from inheriting someone else's old permissions by picking the same name.

Orphaned SIDs. If an account is deleted but its SID is still in a folder's permission list, the Security tab shows the raw SID (S-1-5-21-...) instead of a name. That is called an orphaned SID. It is harmless, and it tells you the account no longer exists.

Names can repeat; SIDs cannot. Two different PCs can each have a user called Admin. Their SIDs differ, so permissions granted to one do not carry to the other.

Tools:

Summary