Get started Bring yourself up to speed with our introductory content.

Where Windows 2000 uses SIDs

This excerpt from Chapter 5 of "The definitive guide to Windows 2000 security" describes three major access control structures where SIDs are used.

Get a glimpse inside Paul Cooke's e-book "The definitive guide to Windows 2000 security" with this series of book excerpts, courtesy of This excerpt is from Chapter 5, "Configuring access control." Click for the book excerpt series or get the full e-book.

Where Windows 2000 uses SIDs

Now that you're becoming familiar with SIDs and recognize that I'll be dealing with them for quite some time, you're probably getting curious about all the places where SIDs are used. Maybe surprisingly, Windows 2000 uses SIDs in only three major access control structures.

  • Access tokens
    Two types of SIDs are used in an access token: One SID identifies who the token represents, and the other SID identifies the security groups that the user is a member of.
  • Security descriptors
    Two types of SIDs are used in a security descriptor: The first SID identifies an object's owner, and the second SID identifies the owner's primary security group affiliation.
  • ACEs
    A SID is used in every ACE to identify the accounts or security groups for which access is allowed, denied, or audited.

I'll discuss the details of each of these structures in later sections of this chapter; for now, it's enough to know where Windows 2000 uses SIDs.

Click for the next excerpt in this series: The structure of a SID

Click for the book excerpt series or get the full e-book.
This was last published in November 2004

Dig Deeper on Windows Server storage management

Start the conversation

Send me notifications when other members comment.

By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Please create a username to comment.