---
description: What is authority that create SID in windows systems ?
---

# SID's Authority

* The authority the issued the SID in windows systems is rely on the network setup the windows device located on.
* ## **Who Creates SIDs in&#x20;**<mark style="color:blue;">**Work-group**</mark>**&#x20;vs&#x20;**<mark style="color:blue;">**Domain**</mark>**&#x20;?**

<table><thead><tr><th width="191">Feature	</th><th width="255">Work-group (Local Accounts)	</th><th>Domain (Active Directory Accounts)</th></tr></thead><tbody><tr><td>Authority</td><td>Local Security Authority (LSA) on each computer</td><td>Active Directory (AD) Domain Controller (DC)</td></tr><tr><td><strong>Scope of SID</strong></td><td>Valid only on that computer</td><td>Valid across the entire domain</td></tr><tr><td>Where It’s Stored</td><td>Security Account Manager (SAM) database <mark style="color:blue;">(C:\Windows\System32\Config\SAM)</mark></td><td>Active Directory Database (NTDS.dit) on Domain Controller</td></tr><tr><td>Account Portability</td><td>Cannot be moved to another machine</td><td>Can be accessed from any domain-joined machine</td></tr><tr><td>How it's created ?</td><td>LSA generates a machine-based SID + RID</td><td>Domain Controller generates a domain-wide SID + RID</td></tr><tr><td>Who controls Account?</td><td>Local administrator</td><td>Domain Administrator</td></tr></tbody></table>

<details>

<summary><mark style="color:blue;">How SID Are Created in a Work-group ?</mark></summary>

* In a **Work-group**, each computer functions **independently**. There is **no central authentication server** like a domain controller.
* **Step-by-Step Process of SID Creation in a Work-group**
  1. **A user account is created (e.g., `saber`)** using:
     * **Control Panel → User Accounts**
     * **Computer Management (`lusrmgr.msc`)**
     * **Command Line (`net user`)**
  2. **The Local Security Authority (LSA) generates a new SID**, which includes:
     * The **computer’s unique machine SID**
     * A **Relative Identifier (RID)** assigned by Windows
  3. **The SID is stored in the Security Account Manager (SAM) database** locally.
  4.  **Example of a Work-group SID:**

      ```
      S-1-5-21-987654321-123456789-543216789-1001
      ```
  5. **Limitations of Work-group SIDs :**
     * **Each computer generates its own SIDs independently**.
     * If the same username is created on another machine, it will get **a different SID**.
     * Work-group accounts **cannot be used on another machine**.

</details>

<details>

<summary><mark style="color:blue;">How SID Are Created in a Domain (Active Directory) ?</mark></summary>

* In a **Domain**, accounts are managed **centrally by a Domain Controller (DC)** using **Active Directory (AD)**.
*   **Step-by-Step Process of SID Creation in a Domain**

    1. **A user account is created** in **Active Directory Users and Computers (ADUC)** or using PowerShell (`New-ADUser`).
    2. **The Domain Controller (DC) assigns a unique SID**, which includes:
       * The **domain’s unique identifier** (instead of a machine SID)
       * A **Relative Identifier (RID)** assigned by the **RID Master** role in AD
    3. **The SID is stored in the Active Directory Database (`NTDS.dit`).**
    4. **Example of a Domain User SID:**

    ```
    S-1-5-21-321654987-741852963-147258369-1103
    ```

    #### &#x20;&#x20;
* #### &#x20;**Advantages of Domain SIDs**

- #### ✅ **Consistent across all domain-joined machines**
- #### ✅ **Users can log into any machine within the domain**
- #### ✅ **Centralized control over permissions and security**

</details>
