technical content. 7/25/2008 5.0.1 Editorial Changed language and formatting in the technical content. 8/29/2008 5.0.2 Editorial Changed language and formatting in the technical content. 10/24/2008 5.1 Minor Clarified the meaning of the technical content. 12/5/2008 5.2 Clarified the meaning of the technical content. 1/16/2009 5.3 Minor Clarified the meaning of the technical content. 2/27/2009 6.0 Major Updated and revised the technical content. 4/10/2009 7.0 Major Updated and revised the technical content. 5/22/2009 8.0 Major Updated and revised the technical content. 7/2/2009 8.1 Clarified the meaning of the technical content.
8/14/2009 8.2 Minor Clarified the meaning of the technical content. 9/25/2009 9.0 Major Updated and revised the technical content. 11/6/2009 10.0 Major Updated and revised the technical content. 12/18/2009 10.0.1 Editorial Changed language and formatting in the technical content. 1/29/2010 11.0 Major Updated and revised the technical content. 3/12/2010 11.1 Minor Clarified the meaning of the technical content. 4/23/2010 11.2 Minor Clarified the meaning of the technical content. 6/4/2010 11.3 Minor Clarified the meaning of the technical content. 7/16/2010 11.3 None No changes to the meaning, language, or formatting of the technical content. 8/27/2010 12.0 Major Updated and revised
the technical content. 9/23/2011 12.2 None No changes to the meaning, language, or formatting of the technical content. 12/16/2011 13.0 Major Updated and revised the technical content. 3/30/2012 14.0 Updated and revised the technical content. 7/12/2012 15.0 Updated and revised the technical content. 10/25/2012 15.0 None No changes to the meaning, language, or formatting of the technical content. 1/31/2013 15.0 None No changes to the meaning, language, or formatting of the technical content. 8/8/2013 16.0 Updated and revised the technical content. 11/14/2013 16.0 None No changes to the meaning, language,
or formatting of the technical content. 2/13/2014 16.0 None No changes to the meaning, language, or formatting of the technical content. 5/15/2014 16.0 None No changes to the meaning, language, or formatting of the technical content. 6/30/2015 17.0 Major Significantly changed the technical content. 10/16/2015 17.0 None No changes to the meaning, language, or formatting of the technical content. 7/14/2016 17.0 None No changes to the meaning, language, or formatting of the technical content. 6/1/2017 17.0 None No changes to the meaning, language, or formatting of the technical content.
S-1-5-21 NT Account Domain AlwaysFilter S-1-5-21-x Partially formed SID AlwaysFilter Partially formed SID AlwaysFilter Invalid domain SID (too many RIDs) AlwaysFilter Identifies a domain, not a principal AlwaysFilter Compounded Authentication NeverFilter<28> Claims Valid NeverFilter<29> R<500 Well-known SID range ForestSpecific Administrator ForestSpecific* Guest ForestSpecific* Krbtgt ForestSpecific* Domain Admins ForestSpecific* Domain Users ForestSpecific* Domain Guests ForestSpecific* Domain Computers ForestSpecific* Domain Controllers ForestSpecific* 500 R X-Y-Z
have been selected as trusted. in the trusted forest. The FtInfo is the collection of domain SIDs in the forest. By default, the FtInfo is the list of all domains in the trusted forest, but it can be configured to be a subset of domain SIDs trusted by the domain. S-1-5-32 Built-in Domain AlwaysFilter Administrators AlwaysFilter Users AlwaysFilter Guests AlwaysFilter Users AlwaysFilter Account Operators AlwaysFilter System Operators AlwaysFilter Print Operators AlwaysFilter Backup Operators AlwaysFilter Replicator AlwaysFilter Ras Servers AlwaysFilter Pre-Win 2k Compatible AlwaysFilter Remote Desktop Users AlwaysFilter Network Configuration Operators AlwaysFilter
S-1-5-32-R Other Built-in Accounts AlwaysFilter Security Providers is the Protocol Extensions security provider value specified in section 2.2.1.1.7. AlwaysFilter Reserved by Microsoft AlwaysFilter Other Organization NeverFilter Extensible NeverFilter S-1-6 SiteServer Authority AlwaysFilter S-1-7 Internet Site Authority AlwaysFilter S-1-8 Exchange Authority AlwaysFilter S-1-9 Resource Manager Authority AlwaysFilter S-1-10 Passport Authority NeverFilter Invalid Invalid SIDs AlwaysFilter crealm Filtering When decoding a cross-realm , the crealm fields inside the TGT are compared to the expected name of the realm for the inter-realm trust. If the names do not match the TGT, they are rejected, subject to other mitigating constraints.<30> These constraints can include allowing fully trusted domains to supply any crealm name on the basis that it would have validated it prior to passing it along, or any other settings that are established out of band. The full set of constraints is implementation-specific. Index of Security Fields Security field Section Supplemental credential encryption