Skip to content

SID Decoder and Well-Known SIDs

Decode a Windows SID (S-1-5-32-544, objectSid hex or Base64, Entra ID S-1-12-1) and look up every well-known SID: Administrators, SYSTEM, Domain Admins…

Paste a SID from a permission list, an event log, whoami /all or a registry key (S-1-5-32-544), or an objectSid in hex or Base64 from an LDAP tool, and see what each part means, which well-known account or group it is, and its other forms. Entra ID SIDs (S-1-12-1-…) are turned back into the object ID, and an object ID into its SID. Domain SIDs you paste are decoded on this page and not put in its address. SIDs and names are Microsoft's (Security identifiers); the explanations are ours.

Try: S-1-5-32-544, S-1-5-18, S-1-1-0, S-1-5-11, S-1-5-21-domain-512, S-1-16-12288

Universal

S-1-0-0 Null SID A group with no members; used where a SID is needed but none applies.
S-1-1-0 Everyone Every user, including Guest and, on old systems, anonymous connections.
S-1-2-0 Local Users who signed in at the computer itself (on a directly connected console).
S-1-2-1 Console Logon Users signed in at the physical console.
S-1-3-0 Creator Owner A placeholder in an inheritable permission: replaced by whoever creates the new object.
S-1-3-1 Creator Group A placeholder in an inheritable permission: replaced by the creator's primary group.
S-1-3-2 Creator Owner Server A placeholder for the owner's server; not used by Windows today.
S-1-3-3 Creator Group Server A placeholder for the primary group's server; not used by Windows today.
S-1-3-4 Owner Rights The object's current owner. A permission for Owner Rights limits what an owner can do (by default owners can always change permissions).

NT Authority

S-1-5-80-0 All Services Every service process configured on the computer.
S-1-5-1 Dialup Users signed in through a dial-up connection.
S-1-5-2 Network Users signed in over the network (file shares, remote management), added to their token for that sign-in.
S-1-5-3 Batch Accounts signed in as a batch job, such as scheduled tasks.
S-1-5-4 Interactive Users signed in interactively, at the console or through Remote Desktop.
S-1-5-6 Service Accounts signed in as a service.
S-1-5-7 Anonymous Logon Connections made without a user name and password (null sessions).
S-1-5-8 Proxy Not used.
S-1-5-9 Enterprise Domain Controllers Every domain controller in the forest.
S-1-5-10 Self A placeholder in Active Directory permissions for the object itself (lets a user edit their own attributes).
S-1-5-11 Authenticated Users Every user and computer that signed in with credentials, including from trusted domains. Not Guest or anonymous.
S-1-5-12 Restricted Code running in a restricted security context.
S-1-5-13 Terminal Server User Users signed in to a Remote Desktop server in the old application-compatibility mode.
S-1-5-14 Remote Interactive Logon Users signed in through Remote Desktop.
S-1-5-15 This Organization Users from the same organization; used with selective authentication on forest trusts.
S-1-5-17 IUSR The IIS anonymous user.
S-1-5-18 SYSTEM Local System: the operating system itself and services running as LocalSystem. More powerful than an administrator.
S-1-5-19 LOCAL SERVICE A low-privilege account for services that need nothing on the network; it connects anonymously.
S-1-5-20 NETWORK SERVICE A low-privilege account for services that need the network; it connects as the computer account.
S-1-5-113 Local account Any local (non-domain) account. Used to block local accounts from network sign-in ("Deny access to this computer from the network").
S-1-5-114 Local account and member of Administrators group Local accounts that are administrators; used the same way, to block network sign-in for local admins.
S-1-5-80 NT Service The prefix of every per-service SID: NT SERVICE\name is S-1-5-80 followed by a hash of the service name (sc showsid name shows it).
S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464 TrustedInstaller NT SERVICE\TrustedInstaller, the Windows Modules Installer service. It owns most system files, so even administrators can't change them without taking ownership first.
S-1-5-83-0 Virtual Machines NT VIRTUAL MACHINE\Virtual Machines: every Hyper-V virtual machine's worker process.
S-1-5-90-0 Window Manager Group The Desktop Window Manager's accounts (Window Manager\DWM-1...).

Built-in group

S-1-5-32-544 Administrators Full control of the computer (on a domain controller, of the domain's DCs).
S-1-5-32-545 Users Ordinary users: can run programs but not change system-wide settings. Domain Users is a member on domain-joined computers.
S-1-5-32-546 Guests Guests: like Users, with a temporary profile. The Guest account is its member (disabled by default).
S-1-5-32-547 Power Users Kept for compatibility; in current Windows it has no more rights than Users.
S-1-5-32-548 Account Operators Domain controllers only: can create and manage most users and groups.
S-1-5-32-549 Server Operators Domain controllers only: can sign in to DCs, manage services and shares, and back up and restore files.
S-1-5-32-550 Print Operators Domain controllers only: can manage printers and load printer drivers on DCs.
S-1-5-32-551 Backup Operators Can back up and restore any file, whatever its permissions, and sign in locally.
S-1-5-32-552 Replicator Used by the old File Replication Service; no members needed today.
S-1-5-32-554 Pre-Windows 2000 Compatible Access Read access to users and groups for old systems.
S-1-5-32-555 Remote Desktop Users Can sign in through Remote Desktop.
S-1-5-32-556 Network Configuration Operators Can change TCP/IP settings and renew addresses.
S-1-5-32-557 Incoming Forest Trust Builders Can create incoming one-way trusts to the forest root domain.
S-1-5-32-558 Performance Monitor Users Can read performance counters, locally and remotely.
S-1-5-32-559 Performance Log Users Can schedule performance counter logging and traces.
S-1-5-32-560 Windows Authorization Access Group Can read users' tokenGroupsGlobalAndUniversal attribute (group membership lookups).
S-1-5-32-561 Terminal Server License Servers Remote Desktop license servers.
S-1-5-32-562 Distributed COM Users Can start and use DCOM objects on the computer.
S-1-5-32-568 IIS_IUSRS IIS application pool identities.
S-1-5-32-569 Cryptographic Operators Can perform cryptographic operations.
S-1-5-32-573 Event Log Readers Can read the event logs, including remotely.
S-1-5-32-574 Certificate Service DCOM Access Can connect to certification authorities (Active Directory Certificate Services).
S-1-5-32-575 RDS Remote Access Servers Remote Desktop gateway and web access servers.
S-1-5-32-576 RDS Endpoint Servers Servers that host Remote Desktop virtual machines and sessions.
S-1-5-32-577 RDS Management Servers Servers that manage Remote Desktop deployments.
S-1-5-32-578 Hyper-V Administrators Full control of Hyper-V on the computer.
S-1-5-32-579 Access Control Assistance Operators Can query authorization attributes and permissions remotely.
S-1-5-32-580 Remote Management Users Can connect with WinRM (PowerShell remoting) without being administrators.
S-1-5-32-582 Storage Replica Administrators Full control of Storage Replica.
S-1-5-32-583 Device Owners Can change system-wide settings on a device they own (Windows 10 and later).

Authentication

S-1-5-64-10 NTLM Authentication Added to the token when the user signed in with NTLM.
S-1-5-64-14 SChannel Authentication Added when the user signed in with a certificate over TLS (Schannel).
S-1-5-64-21 Digest Authentication Added when the user signed in with Digest authentication.
S-1-18-1 Authentication authority asserted identity The sign-in was proven to a domain controller (for example with a password or smart card).
S-1-18-2 Service asserted identity A service vouched for the user (Kerberos protocol transition, S4U), not the user's own credentials.

App container

S-1-15-2-1 ALL APPLICATION PACKAGES Every Store app (app container). Seen in file and registry permissions on system folders.
S-1-15-2-2 ALL RESTRICTED APPLICATION PACKAGES Every app container, including restricted ones (like browser sandboxes).

Integrity level

S-1-16-0 Untrusted Mandatory Level Integrity level of anonymous processes.
S-1-16-4096 Low Mandatory Level Low integrity: sandboxed processes (old Internet Explorer Protected Mode). Can't write to most of the user's own files.
S-1-16-8192 Medium Mandatory Level Medium integrity: normal programs run by a user, including administrators before they elevate (UAC).
S-1-16-8448 Medium Plus Mandatory Level Slightly above medium.
S-1-16-12288 High Mandatory Level High integrity: an elevated ("Run as administrator") process.
S-1-16-16384 System Mandatory Level System integrity: services and the operating system.
S-1-16-20480 Protected Process Mandatory Level Protected processes.

Forest root domain group

S-1-5-21-domain-498 Enterprise Read-only Domain Controllers Every read-only domain controller in the forest.
S-1-5-21-domain-518 Schema Admins Can change the Active Directory schema. Exists only in the forest root domain.
S-1-5-21-domain-519 Enterprise Admins Administrators of every domain in the forest. Exists only in the forest root domain.
S-1-5-21-domain-527 Enterprise Key Admins Can manage key credentials across the forest.

Domain account or group

S-1-5-21-domain-500 Administrator The built-in Administrator account: the domain's, or each computer's own local one (same RID, different domain part).
S-1-5-21-domain-501 Guest The built-in Guest account, disabled by default.
S-1-5-21-domain-502 krbtgt The Key Distribution Center's account: its password key signs every Kerberos ticket in the domain.
S-1-5-21-domain-503 DefaultAccount A local account Windows creates for itself (disabled); on computers, not in AD.
S-1-5-21-domain-504 WDAGUtilityAccount A local account used by Microsoft Defender Application Guard (disabled unless it's used).
S-1-5-21-domain-512 Domain Admins Administrators of the domain: members are local administrators on every domain-joined computer.
S-1-5-21-domain-513 Domain Users Every user account in the domain (their default primary group).
S-1-5-21-domain-514 Domain Guests The domain's guest accounts (the Guest account by default).
S-1-5-21-domain-515 Domain Computers Every computer joined to the domain, except domain controllers.
S-1-5-21-domain-516 Domain Controllers Every writable domain controller in the domain.
S-1-5-21-domain-517 Cert Publishers Enterprise certification authorities, which publish certificates to user and computer objects.
S-1-5-21-domain-520 Group Policy Creator Owners Can create Group Policy objects.
S-1-5-21-domain-521 Read-only Domain Controllers Every read-only domain controller in the domain.
S-1-5-21-domain-522 Cloneable Domain Controllers Domain controllers that may be cloned (virtualized DC cloning).
S-1-5-21-domain-525 Protected Users Members get extra protection: no NTLM, no delegation, no cached credentials, no DES or RC4 Kerberos.
S-1-5-21-domain-526 Key Admins Can manage key credentials (msDS-KeyCredentialLink, Windows Hello for Business) in the domain.
S-1-5-21-domain-553 RAS and IAS Servers Remote access and Network Policy Servers, which may read users' remote access properties.
S-1-5-21-domain-571 Allowed RODC Password Replication Group Accounts whose passwords may be cached on read-only domain controllers.
S-1-5-21-domain-572 Denied RODC Password Replication Group Accounts whose passwords are never cached on read-only domain controllers (admins are in it by default).