Re: SID vs. GUID -- Am I wrong

Get a life... are you really asking questions like this... what happened to my brother?

Re: SID vs. GUID -- Am I wrong

SIDs versus GUIDs
By Paul Cooke
15 Nov 2004 | Realtimepublishers.com


ADVERTISEMENT

Get a glimpse inside Paul Cooke's e-book "The definitive guide to Windows 2000 security" with this series of book excerpts, courtesy of Realtimepublishers.com. This excerpt is from Chapter 5, "Configuring access control." Click for the book excerpt series or get the full e-book.



SIDs versus GUIDs

So far, I've talked a lot about the uniqueness of a SID. A globally unique identifier (GUID) might seem to be the same thing. In a sense it is the same thing, all in the name of backward compatibility. Of course, the details behind this simple explanation are a little more complicated.

As I just mentioned, when a domain account or security group is created, Windows 2000 generates a SID and stores it in an attribute of the new object. In addition to the SID, another type of attribute is set for the object -- its GUID.

A GUID is a 128-bit identifier that is unique to a particular object and is generated from a unique identifier on a device, the current date and time, and a sequence number. The GUID lets any object be uniquely identified because once Windows 2000 issues a GUID, the GUID never changes, even when the object is renamed or moved. As a result, every object stored in AD is assigned a GUID. So while other attributes can change throughout the lifetime of an object, the GUID always stays the same.

However, the SID is one of those object attributes that can sometimes change. For example, let's say that you work for a large international company that has Windows 2000 domains for all of North America and another Windows 2000 domain for the Pacific Rim. After years of dedicated service and hard work, you get your dream transfer from Smallville, USA, to Hong Kong. Instead of being replaced by an all-new account, your account can simply be moved from the NorthAmerica domain into the PacificRim domain. When your account moves into a new domain, it receives a new SID. The rationale for the new SID will make sense when I talk about the structure of a SID in the next section, but for now, just keep in mind that when you move domains, you get a new SID.

After you have a new SID, you need a mechanism to access all the resources that you used to access with your old SID. The mechanism is a SID-History attribute. When your account is moved, Windows 2000 makes a copy of your old SID and stores it in another attribute of your user object before it generates your new SID. In fact, the SID-History attribute can hold multiple values so that no matter how many times your account is moved among domains, your user account object will contain all your old SIDs. Whenever you log on, your access token will hold not only your current SID and the SIDs for all the groups you're a member of but also all your old SIDs. When you access a resource, Windows 2000 will use all of these SIDs to make the necessary access control decision.

Be sure you understand the implications of the SID-History attribute and how it affects the way you grant access to users in your environment. If you directly grant a user access to an object, rather than grant access to a security group to which that user is a member, you may introduce some security issues when you move a user from one Windows 2000 domain to another in the same forest. For example, when you move the user to the new domain, you may not want them to retain access to objects in their original domain. If you routinely granted access to the user explicitly, you'd have to search every resource of the original domain for instances where the user is explicitly used in ACLs. This process is probably not something you'd ever want to do, so be safe and always use security groups for access control, not individual user accounts.

To summarize, I'll relate all of this back to SIDs versus GUIDs. NT 4.0 and earlier use SIDs to uniquely identify accounts and security groups, not GUIDs. So although SIDs seem to be a pain because they can change over time, you shouldn't abandon using them just because GUIDs appear to be (and are) superior. If you abandoned SIDs in Windows 2000 in favor of GUIDs to make access control decisions, you'd be forced to modify all the ACLs on all the resources throughout your entire enterprise! That process would be reason enough to not upgrade to Windows 2000. Thus, although GUIDs would be preferable to SIDs when making access control decisions and would eliminate the concept of SID-History, don't expect Microsoft to make that mistake anytime soon.

designer handbags

I never see so wonderful article. designer handbags uk, many leather designer handbags wholesale, include fashion louis vuitton handbags, louis vuitton leather designer handbags, chanel leather handbags, coach leather handbags, fashion gucci designer handbags, prada leather designer handbags, Balenciaga leather designer handbags, luxury Miu Miu designer handbags, fashion Fendi designer handbags. buy designer handbags - fashionezhone.com. louis vuitton designer handbags uk, buy chanel handbags, coach designer handbags wholesale, gucci handbags sale, prada handbags online, Balenciaga designer handbags uk, Miu Miu designer handbags wholesale, buy Fendi handbags in FashioneZone.com. branded designer handbags wholesale and all of our designer handbags sale, fashion louis vuitton designer handbags, fashion chanel designer handbags, fashion Fendi handbags, coach leather designer handbags, louis vuitton leather handbags, gucci leather designer handbags, prada leather handbags, fashion Balenciaga designer handbags, Miu Miu handbags, luxury Fendi designer handbags. designer handbags uk. buy louis vuitton designer handbags, chanel handbags uk, coach designer handbags online, buy gucci designer handbags, prada handbags wholesale, Balenciaga handbags uk, Miu Miu designer handbags online, Fendi handbags uk, louis vuitton designer handbags sale, chanel designer handbags wholesale, coach designer handbags uk, buy gucci handbags in FashioneZone.com.

Re: SID vs. GUID -- Am I wrong

A Villeroy and [url=http://www.lookforbags.com/]Chanel Replicas[/url] Boch Outlet is part of the Villeroy-Boch AG, a German manufacturer and distributor of home products that are known across the globe. The brand is known for their home and lifestyle products that perfectly fits the various [url=http://www.lookforbags.com/]Chanel Handbags[/url] needs of today's homeowners. [url=http://www.ecoachbags.com/]Coach Bags[/url] These products are great additions to every home. There are two business divisions that comprise the [url=http://www.lookforbags.com/]Chanel Bags[/url] company-the Bathroom and Wellness division, and the Tableware division. [url=http://www.ecoachbags.com/]Coach Outlet[/url]

Bathroom and [url=http://www.ecoachbags.com/]Coach Bags Outlet[/url] Wellness' products include [url=http://www.lookforbags.com/]Prada Replicas[/url] bath tubs, spas and saunas, showering products, bathroom ceramics, and tap fittings [url=http://www.lookforlouboutin.com/]Christian Louboutin Outlet[/url] and radiators. The Tableware division, on the other hand, is [url=http://www.lookforbags.com/]Prada Bags[/url] composed of products like [url=http://www.solorboots.com/]UGGs[/url] stemware, crockery, cutlery, kitchen accessories, [url=http://www.ecoachbags.com/]Coach Handbags[/url] and table textiles. Apart from these, the company also offers tiles [url=http://www.lookforbags.com/]Prada Handbags[/url] products for living room, patios, terrace, bathroom, and for any part of the home, as [url=http://www.soloboots.com/]Discount UGG Boots[/url] well as high- quality kitchen sinks. Homeowners are not [url=http://www.lookforlouboutin.com/]Christian Louboutin Shoes[/url] the only ones who patronize these products, but also hotel and office space owners. [url=http://www.lookforbags.com/]Gucci Replicas[/url]

Company History [url=http://www.ecoachbags.com/]Coach Handbags Outlet[/url]

The company [url=http://www.soloboots.com/]UGG Boots[/url] was first established by [url=http://www.soloboots.com/]UGG Boots on Sale[/url] Francois Boch in Audun le Tiche, France in 1748. The pottery company flourished with the help of Boch's three [url=http://www.lookforbags.com/]Gucci Handbags[/url] sons. Years after its establishment, the company gained many patrons. Boch's [url=http://www.ustnfoutlet.com/]North Face Jacket[/url] transferred the company in Luxembourg which stands until these days. It was [url=http://www.acoach-outlet.com/]Coach Bags[/url] then moved to Mettlach, Germany by the year 1801. [url=http://www.solorboots.com/]UGG Boots Outlet[/url] The name Villeroy and Boch was [url=http://www.lookforlouboutin.com/]Cheap Christian Louboutin Shoes[/url] born when Boch's company merged with a competitor, [url=http://www.acoach-outlet.com/]Coach Outlet[/url] Nicolas Villeroy in 1836.

The newly [url=http://www.solorboots.com/]UGG Boots[/url] built company started operating a [url=http://www.lookforbags.com/]Gucci Bags[/url] factory that specializes in architectural tile in [url=http://www.soloboots.com/]UGGs[/url] 1896. The factories of the company were divided and it went into rough roads because of World War I. When business [url=http://www.soloboots.com/]Cheap UGG Boots[/url] went back to normal in 1951, it opened its very first foreign subsidiary in Argentina. The business continued to flourish with more and more loyal customers in the 1970s and 1980s. This led to the making of the divisions of the brands; [url=http://www.lookforbags.com/]Louis Vuitton Replicas[/url] to put more focus on the manufacturing and [url=http://www.ustnfoutlet.com/]The North Face Jacket[/url] distributing processes in [url=http://www.lookforlouboutin.com/]Discount Christian Louboutin Shoes[/url] the year 1982. As of the end of December 2009, the company already had 24 production plants across the world. It operated via 15 German subsidiaries [url=http://www.solorboots.com/]UGG Boots on Sale[/url] and 46 other foreign subsidiaries. [url=http://www.lookforbags.com/]Louis Vuitton Handbags[/url]

Shopping in an Outlet [url=http://www.lookforbags.com/]Louis Vuitton Bags[/url]

While products in regular Villeroy [url=http://www.ustnfoutlet.com/]North Face Jackets[/url] and Boch stores may cost big for [url=http://www.lookforlouboutin.com/]Christian Louboutin Shoes on Sale[/url] average owners, those that are [url=http://www.solorboots.com/]Discount UGG Boots[/url] available in outlet stores [url=http://www.solorboots.com/]Discount UGGs[/url] are very friendly on the pocket. In fact, people can purchase items that are [url=http://www.ustnfoutlet.com/]The North Face Outlet[/url] 20- 50% cheaper than those in regular stores. These products [url=http://www.acoach-outlet.com/]Coach Outlet Online[/url] are those that were [url=http://www.soloboots.com/]UGG[/url] unsold in regular stores and were eventually faced out, returned by previous customers, or with minor cosmetic imperfections. During special days and [url=http://www.acoach-outlet.com/]Coach Handbags[/url] store clearances, the already discounted prices in a factory outlet are further reduced to [url=http://www.acoach-outlet.com/]Coach Bags Outlet[/url] attract more customers. [url=http://www.ustnfoutlet.com/]The North Face Jackets[/url]

<p><a>As a favorite of British Royal</a>, Barbour company was established in 1894 and insist on producing various high quality <a href="http://www.barbourjacketsale.biz/">Barbour Jackets </a>, <a href="http

As a favorite of British Royal, Barbour company was established in 1894 and insist on producing various high quality Barbour Jackets , Barbour Coats , Barbour Bags, etc. With excellent and durable quality, most people are impressed by this kind of distinctive jacket. Barbour Jacket UK offer all kinds of Men’s Barbour Jackets , Women’s Barbour Jackets and kids Barbour Jackets in big discount. There are a variety of Barbour Jackets, such as Barbour Quilted Jacket , Barbour International Jacket , Barbour Waxed Jacket. In the Barbour Jacket Sale shop, you will easy to get new arrival Barbour Jacket , Barbour Coat with affordable price here, we sale good quality Barbour Jackets without tax and free shipping, welcome!

<p align="left"><a>But moving car is very thick, </a><a href="http://www.timberlandbootsaleuk.net/">timberland boots </a> cars have two or three inches <a href="http://www.timberlandbootsaleuk.net

But moving car is very thick, timberland boots cars have two or three inches Timberland Boots Sale with cutting machine, a few hours can cut a small, and we fear inside the temperature too high, has been used in cooling water gun. Before I in Timberland Boots UK carriage number 16 is close to the carriage number 15 that side, and then I went to the carriage number 15 north and back to 16 Timberland Shoes carriage number, and back to the south to carriage number 16 north Timberland UK.
The carriage number 16, before, Timberland Sale I saw a small boy gut out, Timberland mens Boots a woman's face flat, search and rescue Timberland Womens Boots out of the three, only last a middle-aged man has a faint breathing, but don't know how he now.
Later I in carriage number 15 and 16 carriage number Cheap Timberland Boots also rescued a man between, 15 cars were wallop away rolled up, two car like individual words, Timberland Mens Work Boots   Timberland Mens Sandal   Timberland Mens Roll-Top Boots   Timberland Mens Chukka Boots   Timberland Mens Classic Handsewn   Timberland Mens Boat Shoes   Timberland Mens 6-Inch Premium   Timberland Mens Leisure Shoes   Timberland Womens High Boots   Timberland Womens Slipper  (8)
Timberland Womens 6-Inch Premium   Timberland Women's Roll-Top Boot Timberland Women's Classic Tall   Women's 14 Inch Premium Boots Kids Timberland Boots   he will shrink in the small space.

<p><a>In this cold winter, every people needs a warm garment to against frigid weather and welcome new year. Among all top jacket brand, </a><a href="http://www.barbour-jackets-sale.biz/">Barbour Jacket </a> is on

In this cold winter, every people needs a warm garment to against frigid weather and welcome new year. Among all top jacket brand, Barbour Jacket is one of the high quality garment which founded in 1894, specialized in producing various durable barbour jackets and barbour coat . As an honored brand, barbour jackets are very popular for both men and women. In the Barbour Jacket UK shop, you will easy to get classic Barbour Quilted Jacket , Barbour International Jacket , etc. All kinds of unique style Mens Barbour Jackets , Womens Barbour Jackets and Kids Barbour Jackets hot sale in the Barbour UK , big discount and free shipping.