Let's say for argument's sake I wish to change the SID of a Windows local user account to one that appears on some hypothetical Active Directory domain. Is that possible? If so, how?
P.S. I don't actually need to know how... all I care about is that it is demonstrably possible and that theoretically some malicious user on the network could do this... and how much skill they would need to do so.
It's technically possible to do so, by editing the SAM database (under HKEY_LOCAL_MACHINE\Security in the Registry), but it requires understanding of the binary formats used there. There exist tools that do this, such as NewSid – although it usually did the opposite of what you're looking for, but nevertheless it was able to change the machine SID and user SIDs, computer-wide. The NewSid webpage has some information on how this is done.
However, it won't achieve much. The SID is only used locally. It does not matter what SID you have; it will not give you access to any additional network resources. (This is similar to the arguments given by SysInternals when they discontinued the NewSid utility – it would create a fresh machine SID if you had cloned machines with identical SIDs, but it was explained that having identical machine SIDs, and therefore identical user SIDs, has zero effect on network security.)
For network authentication, Active Directory uses Kerberos and sometimes the (now-deprecated) NTLM, both of which authenticate users using their password or similar credentials.
You can't the Security IDendtifier is built based off of enviroment variables at the time of creation. They are unique, and are not over writable.
The SID for an account or group created in one domain of an enterprise never matches the SID for an account or group created in another domain of the same enterprise.
I would suspect that IF you ever managed to do it, the domain would see it as somesort of oddity and deny access or do other odd things.
