Home / server / Questions / 1023209
Accepted
user1034912
Asked: 2020-06-28 20:43:18 +0800 CST

In Windows Active Driectory, what's the purpose of SIDs when the username is already unique?

  • 772

A Windows ID (such as MyDomain\someuser) will have a unique SID (such as S-1-5-21-1695517229-881958489-217698969-1001)

The ID is used during login, which confirms that it too is unique in nature.

What's the purpose of the SID then?

Seems like a redundant primary key to me!

windows active-directory windows-authentication

1 Answers

  1. Best Answer

    The key difference is that a Security Identifier (SID) is immutable, whereas both SAM Account Name (CONTOSO\USERNAME) and User Principal Name (UPN, [email protected]) can be changed.

    In a Windows Active Directory domain a user might have permissions to resources across many servers and workstations. If all those permissions were bound to usernames, changing usernames would be impossible. As usernames typically are based on real names and people do get married etc., that would be quite impractical.

    • 4