หลายๆ คนคงทราบอยู่แล้วว่าแต่ละ users และ groups ใน Windows จะมี SID ซึ่ง Windows จะใช้ SID ในการทำงานหลายๆ อย่างแทนชื่อ และพวก built-in ที่มากับ Windows อยู่แล้ว พวกนี้จะมี SID ที่แน่นอน และ Windows จะแสดงพวกนี้อยู่ใน domain "NT AUTHORITY"
ทั้งหมดที่แสดงข้างล่างคือที่หามาได้ทั้งหมด (พูดง่ายก็คือ ไม่รู้ว่าหมดหรือยัง)
NULL AUTHORITY : S-1-0
Nobody : S-1-0-0
WORLD AUTHORITY : S-1-1
Everyone : S-1-1-0
LOCAL AUTHORITY : S-1-2
LOCAL : S-1-2-0
CREATOR : S-1-3
CREATOR OWNER : S-1-3-0
CREATOR GROUP : S-1-3-1
CREATOR OWNER SERVER : S-1-3-2
CREATOR GROUP SERVER : S-1-3-3
NONUNIQUE AUTHORITY : S-1-4
NT AUTHORITY : S-1-5
DIALUP : S-1-5-1
NETWORK : S-1-5-2
BATCH : S-1-5-3
INTERACTIVE : S-1-5-4
SERVICE : S-1-5-6
ANONYMOUS LOGON : S-1-5-7
PROXY : S-1-5-8
ENTERPRISE DOMAIN CONTROLLERS : S-1-5-9
SELF : S-1-5-10
Authenticated Users : S-1-5-11
RESTRICTED : S-1-5-12
TERMINAL SERVER USER : S-1-5-13
REMOTE INTERACTIVE LOGON : S-1-5-14
SYSTEM : S-1-5-18
LOCAL SERVICE : S-1-5-19
NETWORK SERVICE : S-1-5-20
BUILTIN : S-1-5-32
Administrators : S-1-5-32-544
Users : S-1-5-32-545
Guests : S-1-5-32-546
Power Users : S-1-5-32-547
Account Operators : S-1-5-32-548
Server Operators : S-1-5-32-549
Print Operators : S-1-5-32-550
Backup Operators : S-1-5-32-551
Replicator : S-1-5-32-552
Pre-Windows 2000 Compatible Access : S-1-5-32-554
Remote Desktop Users : S-1-5-32-555
Network Configuration Operators : S-1-5-32-556
Site Server Authority : S-1-6
Internet Site Authority : S-1-7
Exchange Authority : S-1-8
Resource Manager Authority : S-1-9
และก็นอกจากนี้แล้ว ยังมีอีก 2 user ที่สำคัญ และน่าจำคือ Administrator กับ Guest ซึ่งจะมี RID เป็น 500 กับ 501
"OW" 3-4 OWNER RIGHTS
ReplyDelete5-22 ENTERPRISE READ-ONLY DOMAIN CONTROLLERS BETA
"MU" 5-32-558 BUILTIN\Performance Monitor Users
"LU" 5-32-559 BUILTIN\Performance Log Users
5-32-560 BUILTIN\Windows Authorization Access Group
5-32-561 BUILTIN\Terminal Server License Servers
5-32-562 BUILTIN\Distributed COM Users
5-17 IUSR (used by the default Internet Information Services (IIS) user)
"IS" 5-32-568 A built-in group account for IIS users (Anonymous Internet Users).
"CY" 5-32-569 BUILTIN\Cryptographic Operators
5-21-………-571 ALLOWED Read-Only Domain Controllers PASSWORD_REPLICATION_GROUP
5-21-………-572 DENIED Read-Only Domain Controllers PASSWORD_REPLICATION_GROUP
"ER" 5-32-573 BUILTIN\Event Log Readers
"CD" 5-32-574 BUILTIN\Certificate Service DCOM Access
"RA" 5-32-575 BUILTIN\RDS Remote Access Servers
"ES" 5-32-576 BUILTIN\RDS Endpoint Servers
"MS" 5-32-577 BUILTIN\RDS Management Servers
"HA" 5-32-578 BUILTIN\Hyper-V Administrators
"AA" 5-32-579 BUILTIN\Access Control Assistance Operators
"RM" 5-32-580 BUILTIN\Remote Management Users
"WR" 5-33 WRITE RESTRICTED
5-64-10 NTLM Authentication
5-64-14 SChannel Authentication
5-64-21 Digest Authentication
5-64-36 'Cloud Account Authentication'
(Win7↑) 5-65-1 THIS_ORGANIZATION_CERTIFICATE If the OTHER_ORGANIZATION SID is present (S-1-5-1000), then this SID MUST NOT be present.
5-15 THIS_ORGANIZATION
5-80 NT_SERVICE
5-80-0 All Services
5-82-?* IIS APPPOOL\*
5-83-0 NT VIRTUAL MACHINE\Virtual Machines
"UD" 5-84-0-0-0-0-0 USER_MODE_DRIVERS
5-113 NT AUTHORITY\Local account
5-114 NT AUTHORITY\Local account and member of Administrators group
5-21-0-0-0-496 COMPOUNDED_AUTHENTICATION
5-21-0-0-0-497 CLAIMS_VALID
"RO" 5-21-………-498 Enterprise Read-only domain controllers
"LA" 5-21-………-500 Local administrator
"LG" 5-21-………-501 Local guest
5-21-………-502 KRBTGT A service account that is used by the Key Distribution Center (KDC) service.
"DA" 5-32-512|5-21-………-512 Domain administrators
"DU" 5-32-513|5-21-………-513 DOMAIN_USERS
"DG" 5-32-514|5-21-………-514 DOMAIN_GUESTS
"DC" 5-32-515|5-21-………-515 DOMAIN_COMPUTERS
"DD" 5-32-516|5-21-………-516 DOMAIN_DOMAIN_CONTROLLERS
"CA" 5-21-………-517 CERT_SERV_ADMINISTRATORS|CERT_PUBLISHERS Certificate publishers
"SA" 5-21-………-518 Schema administrators
"EA" 5-32-519|5-21-………-519 Enterprise administrators
"PA" 5-32-520 Group Policy administrators
5-21-………-520 GROUP_POLICY_CREATOR_OWNERS
5-21-………-521 READONLY_DOMAIN_CONTROLLERS
"CN" 5-32-522|5-21-………-522 CLONEABLE_CONTROLLERS
"AP" 5-21-………-525 PROTECTED_USERS
"KA" 5-21-………-526 KEY_ADMINS
"EK" 5-21-………-527 ENTERPRISE_KEY_ADMINS