Revision Summary Date Revision History Revision Class Comments 3/2/2007 1.0 New Version 1.0 release 4/3/2007 1.1 Minor Version 1.1 release 5/11/2007 1.2 Minor Version 1.2 release 6/1/2007 2.0 Major Updated and revised the technical content. 7/3/2007 2.0.1 Editorial Changed language and formatting in the technical content. 8/10/2007 2.0.2 Editorial Changed language and formatting in the technical content. 9/28/2007 3.0 Major Converted to unified format. 10/23/2007 3.0.1 Editorial Changed language and formatting in the technical content. 1/25/2008 4.0 Major Updated and revised the technical content. 3/14/2008 4.1 Minor Clarified the meaning of the technical content. 6/20/2008 5.0 Major Updated and revised the
technical content. 7/25/2008 5.0.1 Editorial Changed language and formatting in the technical content. 8/29/2008 5.0.2 Editorial Changed language and formatting in the technical content. 10/24/2008 5.1 Minor Clarified the meaning of the technical content. 12/5/2008 5.2 Clarified the meaning of the technical content. 1/16/2009 5.3 Clarified the meaning of the technical content. 2/27/2009 6.0 Major Updated and revised the technical content. 4/10/2009 7.0 Major Updated and revised the technical content. 5/22/2009 8.0 Major Updated and revised the technical content. 7/2/2009 8.1 Clarified the meaning of the technical content.
the technical content. 10/8/2010 12.0 None No changes to the meaning, language, or formatting of the technical content. 11/19/2010 12.0 None No changes to the meaning, language, or formatting of the technical content. 1/7/2011 12.1 Minor Clarified the meaning of the technical content. 2/11/2011 12.1 None No changes to the meaning, language, or formatting of the technical content. 3/25/2011 12.1 None No changes to the meaning, language, or formatting of the technical content. 5/6/2011 12.1 None No changes to the meaning, language, or formatting of the technical content. 6/17/2011 12.2 Minor Clarified the meaning of
or formatting of the technical content. 2/13/2014 16.0 None No changes to the meaning, language, or formatting of the technical content. 5/15/2014 16.0 None No changes to the meaning, language, or formatting of the technical content. 6/30/2015 17.0 Major Significantly changed the technical content. 10/16/2015 17.0 None No changes to the meaning, language, or formatting of the technical content. 7/14/2016 17.0 None No changes to the meaning, language, or formatting of the technical content. 6/1/2017 17.0 None No changes to the meaning, language, or formatting of the technical content.
S-1-2-0 Local AlwaysFilter S-1-3-0 Creator Owner AlwaysFilter S-1-3-1 Creator AlwaysFilter S-1-3-2 Creator Owner Server AlwaysFilter S-1-3-3 Creator Group Server AlwaysFilter S-1-4 NonUnique Authority NeverFilter S-1-5 NT Authority AlwaysFilter S-1-5-1 Dialup AlwaysFilter S-1-5-2 Network AlwaysFilter S-1-5-3 Batch AlwaysFilter S-1-5-4 Interactive AlwaysFilter S-1-5-5-* LogonId AlwaysFilter S-1-5-6 Service AlwaysFilter S-1-5-7 Anonymous Logon AlwaysFilter S-1-5-8 Proxy AlwaysFilter S-1-5-9 Enterprise Domain Controllers EDC S-1-5-10 Self AlwaysFilter S-1-5-11 Authenticated AlwaysFilter S-1-5-12 Restricted AlwaysFilter S-1-5-13 Terminal Server User AlwaysFilter S-1-5-14 Remote Interactive User AlwaysFilter S-1-5-15 "This Org" NeverFilter S-1-5-18 Local System AlwaysFilter S-1-5-19 Local Service AlwaysFilter S-1-5-20 Network Service AlwaysFilter
S-1-5-21 NT Account Domain AlwaysFilter S-1-5-21-x Partially formed SID AlwaysFilter Partially formed SID AlwaysFilter Invalid domain SID (too many RIDs) AlwaysFilter Identifies a domain, not a principal AlwaysFilter Compounded Authentication NeverFilter<28> Claims Valid NeverFilter<29> R<500 Well-known SID range ForestSpecific Administrator ForestSpecific* Guest ForestSpecific* Krbtgt ForestSpecific* Domain Admins ForestSpecific* Domain Users ForestSpecific* Domain Guests ForestSpecific* Domain Computers ForestSpecific* Domain Controllers ForestSpecific* 500 R X-Y-Z
Cert Publishers ForestSpecific* Schema Admins ForestSpecific* Enterprise Admins ForestSpecific* Group Policy Creator Owners ForestSpecific* <= < 1000 Except and above Reserved values. Never assigned as primary identities to user accounts. ForestSpecific* R >= 1000 Identifiers for end domain identities and domain groups. Not filtered at domain and external boundaries. Can be filtered at member, quarantined, and cross-forest boundaries. where does not match this <domain>. All Except on trusted domain object (TDO) If the trusting domain is configured to filter all except on TDO, then the domain controller filters all SIDs that are not from the trusted domain. X-Y-Z does not match identities of the domains in a trusted forest that All Except on Forest Trust Information (FtInfo) Identities from other forests. If the trusting domain is configured to filter all except on FtInfo, then the domain controller filters all SIDs that are not from the trusted domains R
A 9 35 C 44 34 Common data types and fields ( 10, 11) 24 Constructed security types 12 12 11 40 18 D Data types and fields common ( 10, 11) 24 Details 10 12 E 30 34 32 30 34 F 40 9 Filtering 40 35 35 G 5 12 I 40 40 8 5 K 11 14 L 9 32 N 7 21 O 8 P 18 35 25 22 20 19 27 26 13 22 12 40 12 12 11 21 20 41 24 21 7 8 7 9 S 24 21 Security 35 40 40 35 40 35 35 structure types 12 12 11 35 SID 35