Tuesday, April 3, 2007

XPe tip #13: SID issues

We all know about possible issues that duplicated SIDs can create in your system setup and open a security hole on the network [ok, if you don't, read this]. Probably the best explanation to these issues were given by Mark Russinovich and Bryce Cogswell on the documentation page for NewSID tool.

Anyway, I am not writing this to start another thread on the SID duplication problem (if you Google for it, there are tons of similar discussion on the subject). I have recently answered a question in the newsgroup where the poster was surprised by not seeing the SIDs under HKEY_USERS key. It appeared that he was looking for long GUID-like subkeys but was playing with Minlogon based image. Here is the thread. As you may read, the poster was looking for actually Admin or User account SID which is not supported by Minlogon.

User SID duplication is not much an issue in Minlogon environment. However, there is still computer SID. You can find that SID somewhere in SAM hive (HKLM\SECURITY\SAM), typically listed in the list of Members keys. Much easier way to find out that SID though is to run PsGetSid utility from sysinternals.com. Here is where you can download it as a part of PsTools package.

Here is a list of well-known SIDs defined by Microsoft.
The one you're definitely going to catch with Minlogon image is S-1-5-18, a special account used by the operating system (aka LocalSystem account).

For Administrator account you would be looking for something like S-1-5-21-191058668-193157475-1542849698-500 on Winlogon images only. The only bolded part is machine dependent and generated randomly. All user accounts on the same system are going to have incrementally increased four last digits of the SID shown above. (1000, 1001, etc. instead of 500).
You can see the list of SIDs assigned to the user accounts on your system by exploring subkeys under [HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList] key.

And last, the good intro into what SID is on MSDN.

5 comments:

baobao said...

It is the goonzu gold which make me very happy these days, my brother says goonzu money is his favorite games gold he likes, he usually buy some goonzu online gold to start his game and most of the time he will win the buy goonzu gold back and give me some cheap goonzu gold to play the game.
I always heard something from my neighbor that he sometimes goes to the internet bar to play the game which will use him some gw gold,he usually can win a lot of GuildWars Gold,then he let his friends all have some Guild Wars Gold,his friends thank him very much for introducing them the GuildWars money,they usually cheap gw gold together.

cheap kamas said...

Now do you worried about that in the game do not had enough cabal online alz to play the game, now you can not worried, my friend told me a website, in here you can buy a lot cabal alz and only spend a little money, do not hesitate, it was really, in here we had much cabal gold, we can sure that you will get the cabal money, quick to come here to buy cabal alz.

I like play online game, I also buy dofus kamas and kamas, the cheap kamas is very cheap, and use the dofus gold can buy many things, I like dofus kama, thanks, it is very good.

aion china server kina said...

aion china, aion china gold,
aion cn goldaion chinese gold,
aion gold chinaaion gold chinese,
china aion goldchinese aion gold,
aion china kinaaion chinese kina,
aion kina chinachina aion kina,
aion china buybuy aion china,
aion chinese server goldaion cn server gold,
aion china server goldchina aion server gold,
chinese aion server goldaion chinese server gold,
aion cn server kinaaion china server kina,
china aion server kinachinese aion server kina

Anonymous said...

29047126483369175 I play dofus Replica Watches for one year, I Replica Rolex Watches want to get some Replica Watch kamas to buy Replica Chanel Watches item for my character. So, I search "Replica Swiss Watches" on google and found many website. As Exact Replica Graham Watch the tips from the forum, I just review the Swiss Replica Watches websites and choose some Replica Montblanc Watches quality sites to Replica Cartier Watches compare the price, and go to their Replica Breguet Watches online support to make Replica Breitling Watches the test. And Last Chaos Gold I decide to use Replica BRM Watch at the end. And Tag Heuer Replica Watch that is the Replica IWC Watch beginning..

Adi said...

thanks for sharing this info. greets from Pandeglang. Pandeglang is one of many places in Indonesia are eligible for tourist destination.
Kenali dan Kunjungi Objek Wisata di Pandeglang Objek Wisata di Pandeglang Kenali dan Kunjungi Objek Wisata di Pandeglang Pantai Carita Seni Saman Rampak Bedug