Skip to content

S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464: TrustedInstaller

SID Decoder and Well-Known SIDs: Decode a Windows SID (S-1-5-32-544, objectSid hex or Base64, Entra ID S-1-12-1) and look up every well-known SID: Administrators, SYSTEM, Domain Admins…

Paste a SID from a permission list, an event log, whoami /all or a registry key (S-1-5-32-544), or an objectSid in hex or Base64 from an LDAP tool, and see what each part means, which well-known account or group it is, and its other forms. Entra ID SIDs (S-1-12-1-…) are turned back into the object ID, and an object ID into its SID. Domain SIDs you paste are decoded on this page and not put in its address. SIDs and names are Microsoft's (Security identifiers); the explanations are ours.

Try: S-1-5-32-544, S-1-5-18, S-1-1-0, S-1-5-11, S-1-5-21-domain-512, S-1-16-12288

TrustedInstaller
NT Authority

NT SERVICE\TrustedInstaller, the Windows Modules Installer service. It owns most system files, so even administrators can't change them without taking ownership first.

A service SID (NT SERVICE\name): the numbers are a SHA-1 hash of the service name in capitals. sc showsid name gives a service's.

Parts

Revision1
Identifier authority5 NT Authority
Sub-authority 180
Sub-authority 2956008885
Sub-authority 33418522649
Sub-authority 41831038044
Sub-authority 51853292631
Sub-authority 62271478464

Other forms

SIDS-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464
objectSid (hex)010600000000000550000000B589FB381984C2CB5C6C236D5700776EC0026487
objectSid (Base64, as in LDIF)AQYAAAAAAAVQAAAAtYn7OBmEwstcbCNtVwB3bsACZIc=
LDAP filter(objectSid=\01\06\00\00\00\00\00\05\50\00\00\00\b5\89\fb\38\19\84\c2\cb\5c\6c\23\6d\57\00\77\6e\c0\02\64\87)
Name on a Windows computer (PowerShell)([System.Security.Principal.SecurityIdentifier]'S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464').Translate([System.Security.Principal.NTAccount]).Value