Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Let's say for argument's sake I wish to change the SID of a Windows local user account to one that appears on some hypothetical Active Directory domain. Is that possible? If so, how?

P.S. I don't actually need to know how... all I care about is that it is demonstrably possible and that theoretically some malicious user on the network could do this... and how much skill they would need to do so.

share|improve this question

It's technically possible to do so, by editing the SAM database (under HKEY_LOCAL_MACHINE\Security in the Registry), but it requires understanding of the binary formats used there. There exist tools that do this, such as NewSid – although it usually did the opposite of what you're looking for, but nevertheless it was able to change the machine SID and user SIDs, computer-wide. The NewSid webpage has some information on how this is done.

However, it won't achieve much. The SID is only used locally. It does not matter what SID you have; it will not give you access to any additional network resources. (This is similar to the arguments given by SysInternals when they discontinued the NewSid utility – it would create a fresh machine SID if you had cloned machines with identical SIDs, but it was explained that having identical machine SIDs, and therefore identical user SIDs, has zero effect on network security.)

For network authentication, Active Directory uses Kerberos and sometimes the (now-deprecated) NTLM, both of which authenticate users using their password or similar credentials.

share|improve this answer
Goodness knows what would happen if you tried to change the local machine SID to be the same as the domain SID. You could expect all sorts of things to go wrong. As you say, though, it wouldn't give you any special privilege in the domain. – Harry Johnston Apr 30 '13 at 4:42

You can't the *S*ecurity *ID*endtifier is built based off of enviroment variables at the time of creation. They are unique, and are not over writable.

If you need more information:

The SID for an account or group created in one domain of an enterprise never matches the SID for an account or group created in another domain of the same enterprise.

I would suspect that IF you ever managed to do it, the domain would see it as somesort of oddity and deny access or do other odd things.

share|improve this answer
That's just what I was hoping to hear. My manager just needs to hear it from someone other than me as he thinks this can be changed no problem... which I say is BS :D – BenAlabaster Apr 10 '13 at 19:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .