Course 36 - Windows Forensics and Tools | Episode 5: Structure and Forensic Significance

In this lesson, you’ll learn about: Windows Security Identifiers (SIDs) and user tracking1. What is a Security Identifier (SID)?

• A SID (Security Identifier) is a unique value assigned to every:
  • User
  • Group
  • Security principal (system accounts, services)

🔹 Core Idea

• It acts like a permanent digital fingerprint in Windows
• Used internally instead of usernames

👉 Key Property:

• A SID is never reused, even if the account is deleted

2. Why SIDs Exist

• Windows needs a stable way to identify identities
• Usernames can change
• SIDs cannot

🔹 Example Use

• Permissions are assigned to SIDs, not names
• Access control checks rely on SID matching

3. SID in Access Tokens🔹 What happens at login?

• Windows creates an access token
• This token contains:
  • User SID
  • Group SIDs
  • Privileges

👉 Key Insight:

• Every process inherits this token
• This determines what the user can do

4. Structure of a SIDA SID is not random—it has a strict format:🔹 Main Components

• Identifier Authority
• Sub-authority values
• Relative Identifier (RID)

5. SID Breakdown Explained🔹 Identifier Authority

• Defines the system or domain origin
• Example:
  • Local machine
  • Domain controller

🔹 Sub-authorities

• Represent hierarchical security structure
• Provide organizational uniqueness

🔹 Relative Identifier (RID)

• The most specific part
• Identifies the actual account

6. Important RID Examples🔹 Common Built-in Accounts

• 500 → Built-in Administrator
• 501 → Guest account
• 512 → Domain Admins group
• 513 → Domain Users group

🔹 Special Group

• “Everyone” group → universal access SID

👉 Key Insight:

• RID tells you exactly what type of account it is

7. How SIDs Are Used in Security🔹 Access Control

• File permissions are assigned to SIDs
• Not usernames

🔹 Authentication Flow

• Login → SID loaded → permissions applied

8. Forensic Importance of SIDs🔹 What investigators can learn

• Which user performed an action
• Whether an account was deleted or renamed
• Privilege escalation attempts

🔹 Why it matters

• Even if usernames change, SID stays the same
• Enables long-term tracking of user behavior

Key Takeaways

• SIDs are permanent unique identifiers in Windows
• They are used instead of usernames for security decisions
• Stored inside access tokens during login
• Structured into authority, sub-authority, and RID
• Essential for forensic tracking and access control

Big PictureSIDs help you:👉 Move from “who is the user?” → “what identity is truly behind the action?”Mental Model

• Username → Human label
• SID → System truth

You can listen and download our episodes for free on more than 10 different platforms:
https://linktr.ee/cybercode_academy