A customer wanted to create a user with a specific SID prefix:<\/p>\n
\nWe know that you can’t create a user with a specific SID, but can we at least create it with a specific SID prefix?<\/p>\n
We na\u00efvely tried this:<\/p>\n
net user \/add Fred\r\nnet localgroup \"Cryptographic Operators\" Fred \/add\r\n<\/pre>\nSince the Cryptographic Operators group SID is S-1-5-32-569, we expected that the newly-created user “Fred” would have a SID of the form S-1-5-32-569-(random)-1000, but it doesn’t.<\/p>\n
How do we create a user with a specific SID prefix? We want Fred to be a member of the “Cryptographic Operators” group, so we need the user SID to be under the “Cryptographic Operators” SID.<\/p>\n<\/blockquote>\n
Okay, that’s not how SID prefixes work.<\/p>\n
Group membership is not controlled by SID prefixes. It is not the case that all members of the “Cryptographic Operators” group have a SID prefix of S-1-5-32-569, nor is it the case that you must have that prefix in order to be a member of the “Cryptographic Operators” group.<\/p>\n
In fact, S-1-5-32-569 is not a legal SID prefix at all, since it is not a so-called domain identifier<\/i>, which is the fancy name for “a thing that can produce new SIDs via suffixing.”<\/p>\n
If you think about it, it makes sense that group membership is not controlled by SID prefixes. After all, a user can belong to multiple groups: You are probably a member of the local Administrators group (S-1-5-32-544), the Remote Desktop Users group (S-1-5-32-555), the Users group (S-1-5-32-545), the Authenticated Users group (S-1-5-11), and a whole bunch of others. But you have only one SID, so it can’t have all of those groups as a prefix.<\/p>\n
Group membership is determined by entries in the user’s token, and those entries are placed there at token creation based on the group memberships. When the system later wants to check if a user is in a group, it does so by looking in the token to see if there is an entry for that group in the token. It doesn’t do it by doing a prefix check on the user SID.<\/p>\n
You have your gym membership card in your wallet, but that doesn’t mean that you were born at the gym. Your national identity number was issued by Stockholm, but that doesn’t prevent you from being a registered resident of G\u00f6teborg.<\/p>\n
The way to create a user in a group is to do exactly what the customer did: Create the user (which will assign them a SID), and then add the user to the groups you want them to be members of (which will add them in the group membership database).<\/p>\n
The numeric properties of the SID are not important. As long as each entity gets a unique SID, that’s the important thing. The prefixing technique is just a way to make sure that separate SID-creating entities can create unique SIDs without colliding with each other: If you give each SID-creating entity a unique prefix to stamp onto its created SIDs, then you can be sure that their SIDs won’t collide.<\/p>\n
Bonus chatter<\/b>: Although the numeric properties are not important from a security standpoint, you can use knowledge of the SID-assignment algorithm to infer information about the circumstances of the SID’s creation, in the same way that looking at a person’s national identity number tells you where they were born.\u00b9 For example, by looking at the SID, you can determine which SID-creating entity issued it, and from the RID you can infer which domain controller was used<\/a>.<\/p>\n
\u00b9 In 1990, Sweden stopped encoding geographic information in the national identity number, so that trick works only for older people.<\/p>\n","protected":false},"excerpt":{"rendered":"
The prefix doesn’t define group membership.<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[26],"class_list":["post-107675","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-other"],"acf":[],"blog_post_summary":"
The prefix doesn’t define group membership.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/107675","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=107675"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/107675\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=107675"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=107675"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=107675"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}