{"id":43413,"date":"2014-12-12T07:00:00","date_gmt":"2014-12-12T07:00:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/2014\/12\/12\/detecting-whether-a-sid-is-well-known-sid\/"},"modified":"2014-12-12T07:00:00","modified_gmt":"2014-12-12T07:00:00","slug":"detecting-whether-a-sid-is-well-known-sid","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20141212-00\/?p=43413","title":{"rendered":"Detecting whether a SID is well-known SID"},"content":{"rendered":"

\nYou might think that the Is­Well­Known­Sid<\/code>\nfunction would tell you whether a SID is well-known, but it doesn’t.\nRather,\nit tells you whether a SID exactly matches the well-known SID\nyou specified.\nFor example, you can ask,\n“Is this the Authenticated Users<\/i> SID?”\nor\n“Is this the Everyone<\/i> SID?”\nBut you can’t ask,\n“Is this any type of well-known SID?”\n<\/p>\n

\nI guess you could enumerate through all the well-known SIDs,\nand check if your SID matches any of them,\nbut that’s getting kind of ugly.\n<\/p>\n

\nIf what you’re interested in is\nwhether this is a machine-relative SID\n(or a domain-relative SID, which is the special case where the machine\nis the domain controller),\nas opposed to a universal SID,\nyou can check whether the SID format is S-1-5-21<\/b>-#-#-#-#.\nAll machine-relative SIDs have that form.\n<\/p>\n

\n#define SECURITY_NT_NON_UNIQUE          (0x00000015L) \/\/ decimal 21\n#define SECURITY_NT_NON_UNIQUE_SUB_AUTH_COUNT  (3L)\n<\/pre>\n
\nIf you want to exclude\nmachine\\Administrator<\/code> and\nother predefined machine-relative SIDs,\nyou can verify that the last number\n(the RID) is greater than or equal to 1000.\n<\/p>\n
\n#define SECURITY_OTHER_ORGANIZATION_RID (0x000003E8L)\n<\/pre>\n","protected":false},"excerpt":{"rendered":"
You might think that the Is­Well­Known­Sid function would tell you whether a SID is well-known, but it doesn’t. Rather, it tells you whether a SID exactly matches the well-known SID you specified. For example, you can ask, “Is this the Authenticated Users SID?” or “Is this the Everyone SID?” But you can’t ask, “Is this […]<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[25],"class_list":["post-43413","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-code"],"acf":[],"blog_post_summary":"
You might think that the Is­Well­Known­Sid function would tell you whether a SID is well-known, but it doesn’t. Rather, it tells you whether a SID exactly matches the well-known SID you specified. For example, you can ask, “Is this the Authenticated Users SID?” or “Is this the Everyone SID?” But you can’t ask, “Is this […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/43413","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=43413"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/43413\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=43413"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=43413"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=43413"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}