Users refer to accounts by using the account name, but the operating system internally refers to accounts and processes that run in the security context of the account by using their security identifiers SIDs.
SIDs are unique within their scope domain or local , and they are never reused. The operating system generates a SID that identifies a particular account or group at the time the account or group is created.
The SID for a local account or group is generated by the Local Security Authority LSA on the computer, and it is stored with other account information in a secure area of the registry. The SID for a domain account or group is generated by the domain security authority, and it is stored as an attribute of the User or Group object in Active Directory Domain Services.
For every local account and group, the SID is unique for the computer where it was created. No two accounts or groups on the computer ever share the same SID.
Likewise, for every domain account and group, the SID is unique within an enterprise. This means that the SID for an account or group that is created in one domain will never match the SID for an account or group created in any other domain in the enterprise. SIDs always remain unique. For example, if a user with a user account in a Windows domain leaves her job, an administrator deletes her Active Directory account, including the SID that identifies the account.
If she later returns to a different job at the same company, an administrator creates a new account, and the Windows Server operating system generates a new SID.
The new SID does not match the old one; so none of the user's access from her old account is transferred to the new account.
Her two accounts represent two completely different security principals. A security identifier is a data structure in binary format that contains a variable number of values. The first values in the structure contain information about the SID structure. The following image illustrates the structure of a SID. The components of a SID are easier to visualize when SIDs are converted from a binary to a string format by using standard notation:.
The SID's most important information is contained in the series of subauthority values. The first part of the series -Y1-Y2-Y n -1 is the domain identifier. This element of the SID becomes significant in an enterprise with several domains, because the domain identifier differentiates SIDs that are issued by one domain from SIDs that are issued by all other domains in the enterprise. No two domains in an enterprise share the same domain identifier.
The last item in the series of subauthority values -Y n is the relative identifier. It distinguishes one account or group from all other accounts and groups in the domain.
No two accounts or groups in any domain share the same relative identifier. SIDs for built-in accounts and groups always have the same domain identifier value: This value identifies the domain Builtin , which exists on every computer that is running a version of the Windows Server operating system.
It is never necessary to distinguish one computer's built-in accounts and groups from another computer's built-in accounts and groups because they are local in scope. They are local to a single computer, or in the case of domain controllers for a network domain, they are local to several computers that are acting as one.
Built-in accounts and groups need to be distinguished from one another within the scope of the Builtin domain. Therefore, the SID for each account and group has a unique relative identifier. A relative identifier value of is unique to the built-in Administrators group. No other account or group in the Builtin domain has a SID with a final value of No other domain in the enterprise uses this value as its domain identifier. No other account or group in the domain has a SID with a final value of When accounts and groups are stored in an account database that is managed by a local Security Accounts Manager SAM , it is fairly easy for the system to generate a unique relative identifier for each account and in a group that it creates on a stand-alone computer.
The SAM on a stand-alone computer can track the relative identifier values that it has used before and make sure that it never uses them again. In a network domain, however, generating unique relative identifiers is a more complex process. Windows Server network domains can have several domain controllers.
Each domain controller stores Active Directory account information. This means that, in a network domain, there are as many copies of the account database as there are domain controllers.
In addition to this, every copy of the account database is a master copy. New accounts and groups can be created on any domain controller.
Changes that are made to Active Directory on one domain controller are replicated to all other domain controllers in the domain. The process of replicating changes in one master copy of the account database to all other master copies is called a multimaster operation.
The process of generating unique relative identifiers is a single-master operation. One domain controller is assigned the role of relative identifier RID master, and it allocates a sequence of relative identifiers to each domain controller in the domain. When a new domain account or group is created in one domain controller's replica of Active Directory, it is assigned a SID.
The relative identifier for the new SID is taken from the domain controller's allocation of relative identifiers. When its supply of relative identifiers begins to run low, the domain controller requests another block from the RID master.
Each domain controller uses each value in a block of relative identifiers only once. The RID master allocates each block of relative identifier values only once.
This process assures that every account and group created in the domain has a unique relative identifier. It also assigns the new object a globally unique identifier GUID , which is a bit value that is unique not only in the enterprise, but also across the world. For example, the GUID is one of an object's properties that is published in the global catalog.
Searching the global catalog for a User object GUID produces results if the user has an account somewhere in the enterprise. In fact, searching for any object by ObjectGUID might be the most reliable way of finding the object you want to locate. When an object is assigned a GUID, it keeps that value for life. If a user moves from one domain to another, the user gets a new SID. The SID for a group object does not change because groups stay in the domain where they were created.
However, if people move, their accounts can move with them. If the administrator does this, the User object for the account needs a new SID.
ScriptingGuy1 December 6, I need to get back a list of all the computers in my domain, except for the computers which are in our Test Lab OU. How do I do that? ScriptingGuy1 December 7, NET Core. Recordset ADOR. Paste your code snippet. This is a big drawback; assuming you're able, you're much better off using the wmic command method above. Enter the user's information and follow prompts. Actively scan device characteristics for identification.
Use precise geolocation data. Select personalised content. Create a personalised content profile. Measure ad performance. Select basic ads. Create a personalised ads profile. Select personalised ads. Apply market research to generate audience insights.
Measure content performance. Develop and improve products. The SID will be changed to another one. Share Facebook Twitter LinkedIn. Notify of. Inline Feedbacks.
0コメント