In Windows Active Driectory, what's the purpose of SIDs when the username is already unique?

Question

A Windows ID (such as MyDomain\someuser) will have a unique SID (such as S-1-5-21-1695517229-881958489-217698969-1001)

The ID is used during login, which confirms that it too is unique in nature.

What's the purpose of the SID then?

Seems like a redundant primary key to me!

score 4 · Accepted Answer · answered Jun 28 '20 at 06:12

4

The key difference is that a Security Identifier (SID) is immutable, whereas both SAM Account Name (CONTOSO\USERNAME) and User Principal Name (UPN, username@contoso.com) can be changed.

In a Windows Active Directory domain a user might have permissions to resources across many servers and workstations. If all those permissions were bound to usernames, changing usernames would be impossible. As usernames typically are based on real names and people do get married etc., that would be quite impractical.

answered Jun 28 '20 at 06:12

Esa Jokinen

43,252
2
75
122

+1 To getting married... didn't think about that! – user1034912 Jun 28 '20 at 07:56
Some even keep both surnames, causing their real names become too long for the SAM Account Name. That's so reckless! Apparently being in love makes them completely forget about their kind IT administrators. ;) – Esa Jokinen Jun 28 '20 at 08:01
IT administrator are always in love :) But not to a human! – user1034912 Jun 28 '20 at 08:02

In Windows Active Driectory, what's the purpose of SIDs when the username is already unique?

1 Answers1