Skip to content

S-1-5-21-domain-502: krbtgt

SID Decoder and Well-Known SIDs: Decode a Windows SID (S-1-5-32-544, objectSid hex or Base64, Entra ID S-1-12-1) and look up every well-known SID: Administrators, SYSTEM, Domain Admins…

Paste a SID from a permission list, an event log, whoami /all or a registry key (S-1-5-32-544), or an objectSid in hex or Base64 from an LDAP tool, and see what each part means, which well-known account or group it is, and its other forms. Entra ID SIDs (S-1-12-1-…) are turned back into the object ID, and an object ID into its SID. Domain SIDs you paste are decoded on this page and not put in its address. SIDs and names are Microsoft's (Security identifiers); the explanations are ours.

Try: S-1-5-32-544, S-1-5-18, S-1-1-0, S-1-5-11, S-1-5-21-domain-512, S-1-16-12288

krbtgt
Domain account or group
privileged

The Key Distribution Center's account: its password key signs every Kerberos ticket in the domain.

Whoever has its key can forge tickets (golden tickets). Reset it twice, with replication in between, after a compromise.

In a real SID the word "domain" is the domain's (or, for local accounts, the computer's) identifier: three numbers, as in S-1-5-21-1004336348-1177238915-682003330-502. Every domain has its own.

Find it in your domain Get-ADObject -Filter "objectSid -eq '$((Get-ADDomain).DomainSID)-502'"