Skip to content

S-1-5-32-554: Pre-Windows 2000 Compatible Access

SID Decoder and Well-Known SIDs: Decode a Windows SID (S-1-5-32-544, objectSid hex or Base64, Entra ID S-1-12-1) and look up every well-known SID: Administrators, SYSTEM, Domain Admins…

Paste a SID from a permission list, an event log, whoami /all or a registry key (S-1-5-32-544), or an objectSid in hex or Base64 from an LDAP tool, and see what each part means, which well-known account or group it is, and its other forms. Entra ID SIDs (S-1-12-1-…) are turned back into the object ID, and an object ID into its SID. Domain SIDs you paste are decoded on this page and not put in its address. SIDs and names are Microsoft's (Security identifiers); the explanations are ours.

Try: S-1-5-32-544, S-1-5-18, S-1-1-0, S-1-5-11, S-1-5-21-domain-512, S-1-16-12288

Pre-Windows 2000 Compatible Access
Built-in group

Read access to users and groups for old systems.

If it contains Everyone or Anonymous Logon, anonymous users can enumerate the domain; Authenticated Users only is the safer setting.

A built-in local group (BUILTIN\...).

Parts

Revision1
Identifier authority5 NT Authority
Sub-authority 132
Sub-authority 2554

Other forms

SIDS-1-5-32-554
objectSid (hex)0102000000000005200000002A020000
objectSid (Base64, as in LDIF)AQIAAAAAAAUgAAAAKgIAAA==
LDAP filter(objectSid=\01\02\00\00\00\00\00\05\20\00\00\00\2a\02\00\00)
Name on a Windows computer (PowerShell)([System.Security.Principal.SecurityIdentifier]'S-1-5-32-554').Translate([System.Security.Principal.NTAccount]).Value