Security Identifier - Duplicated SIDs

Duplicated SIDs

The problem with duplicated SIDs in a Workgroup of computers running Windows NT/2K/XP is only related to different user accounts having the same SID. This could lead to unexpected access to shared files or files stored on a removable storage: If some access control lists are set on a file, the actual permissions can be associated with a user SID. If this user SID is duplicated on another computer (because the computer SID is duplicated and because the user SIDs are built based on the computer SID and a sequential number), a user of a second computer having the same SID could have access to the files that the user of a first computer has protected.

Now the truth is that when the computers are joined into a domain (Active Directory or NT domain for instance), each computer has a unique Domain SID which is recomputed each time a computer enters a domain. Thus there are usually no real problems with duplicated SIDs when the computers are members of a domain, especially if local user accounts are not used. If local user accounts are used, there is a potential security issue that is the same as the one described above when the computers are members of a Workgroup but that affects only the files and resources protected by local users, not by domain users.

In other words, duplicated SIDs are usually not a problem with Microsoft Windows systems. Microsoft used to provide the '"NewSID" utility to change a machine SID.

But other programs that detect SIDs might have problems with its security.

After NewSID's retirement, Microsoft engineer Mark Russinovich posted an article on his blog explaining the retirement of the NewSID stating that neither he nor the Windows security team could think of any situation where duplicate SIDs could cause any problems at all, against commonly accepted wisdom.

On November 1, 2009, Microsoft added the following to the NewSID download page:

Note: NewSID will be retired from Sysinternals on November 2, 2009.

At present, the only supported mechanism for duplicating disks for Windows operating systems is through use of SysPrep.