We help IT Professionals succeed at work.

Active Directory Group SID

jskfan
jskfan asked
on
Active Directory Group SID

I have read online that SID  and GUID  are created whenever you create new object in Active Directory.
SID is only unique in its Domain , GUID unique in its forest and even world wide.
Not sure how GUID uniqueness is controlled world wide ?

For SID if it is user object and it is moved out of the domain, its SID will change.

What about the SID related to user Group, will that be changed if it is moved to another Domain ?

Thank you
Comment
Watch Question

Managing Consultant
CERTIFIED EXPERT
Commented:
It's algorithmic. "To a very high degree of certainty, this function returns a unique value – no other invocation, on the same or any other system (networked or not), should return the same value."

https://docs.microsoft.com/en-us/windows/win32/api/combaseapi/nf-combaseapi-cocreateguid

Is it possible for a GUID to collide? Yes. But it's very unlikely.

If a group is moved to another domain, what happens to it's SID? It depends. How was it copied? Generally speaking you expect a new SID and a copy of the old SID is maintained in an object attribute named SIDHistory. Same as for a user.
Henrik JohanssonSystems engineer
Top Expert 2008

Commented:
It doesn't matter of object class (user, group etc).
Object's SID is based on domain's SID + object's RID in current domain, and the object's SID will change when moving object to another domain
Object's previous SID is stored in SIDhistory attribute on object.

Author

Commented:
Thank you