Computer accounts, user accounts, groups, and different security - attached objects are security principles.
Security Identifiers ( SIDs ) unambiguously identify security principles.
Every time Windows XP or Active Directory generates a security principle, they generate a SID for it.
Windows XP ' s Local Security Authority ( LSA ) makes SIDs for local security principles and then lays them in the local security database.
The Domain Security Authority generates SIDs for domain security principles and then stores them in Active Directory.
SIDs are unique within their scope.
Every local security principle ' s SID is unique on the computer.
And every domain security principle ' s SID is unique within any domain in the enterprise.
What ' s more, Windows XP and Active Directory never reuse a SID, even if they delete the security principle to which that SID belonged.
Thus, if you delete an account and then add it back, the account gets a new SID.
The important thing to remember is that every account has a SID.
It ' s kind of like having a passport number that uniquely identifies you to immigration.
You can refer to an account by its name or by its SID, but in practice you seldom use the SID because its format is cumbersome.
You frequently see accounts ' SIDs in the registry.
An example of a SID is S - 1 - 5 - 21 - 2857422465 - 1465058494 - 1690550294 - 500.
A SID always begins with S -.
The next number identifies the SID ' s version-in this case, version 1.
The next number indicates the identifier authority and is usually 5, which is NT Authority.
The string of numbers up to 500 is the domain identifier, and the rest of the SID is a relative identifier, which is the account or group.
Some SIDs are shorter than the previous example, such as S - 1 - 5 - 18.
These are well - known SIDs, and they are the same on every computer and in every domain.
They are interesting because they pop up over and over again in the registry and in other places.