jperezduerto.info
Security in depth · Unit 22 · Lesson 25 of 44
SIDs identify security principals
Read an account-lifecycle record without confusing a reused name with an existing identity.
Helpful before thisWindows privilege escalation
After this lesson you can
- Distinguish access after an account rename from access after deletion and recreation.
Read the identity, not just the label
A security identifier, or SID, identifies a Windows security principal such as a user or group. Tokens and permission entries use these identifiers. A display name is a readable label. Renaming an existing account preserves its SID; deleting it and creating a new account gives the new account a different SID.
A fictional lifecycle record
The Cedar archive supplies three records. SID A and SID B are short fictional aliases, not literal Windows SID strings.
| Record | Name | Identity |
|---|---|---|
| Original account | ArchiveHelper | SID A |
| Same account, renamed | ArchiveReader | SID A |
| New account after deletion | ArchiveHelper | SID B |
One file grant permits SID A to read. Assume fresh ordinary tokens, no additional group grants, no migration-related SID history, and no privileged override. The renamed account still matches that grant. The replacement does not, even though its name resembles the original.
Make a scoped access decision
The replacement account needs an owner-approved decision based on its present role. Automatically copying all of the deleted account’s access could preserve permissions that nobody now needs. An unresolved SID in an old permission record is a reason to investigate ownership and lifecycle history, not proof of malicious activity.
Record the resource, SID, approved purpose, and planned disposition of the old grant. A permission record shows authority; it does not establish that either account read the file. Keep that historical question separate from the current access decision.
Terms you met
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
The old account is deleted and a replacement has the same name but SID B. The only relevant grant names SID A. What follows?
Show the answer
Correct answer: The old grant does not authorize SID B; review the replacement role and its required access. The supplied token has no matching identity or group grant. A repeated name does not restore the deleted principal.
Try it
- WriteWrite two access-review lines: the renamed account and the replacement account. State which SID matches the existing grant, which needs a new owner-approved access decision, and what historical use remains unknown.