Microsoft KB Archive/276208

= How to convert the SDDL form of an SID to a SAM account name =

Article ID: 276208

Article Last Modified on 3/29/2007

-

APPLIES TO


 * Microsoft Windows 2000 Server
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows NT Server 4.0 Standard Edition

-



This article was previously published under Q276208



SUMMARY
This article shows how the Security Descriptor Definition Language (SDDL) form of a security identifier (SID) can be converted into the Security Accounts Manager (SAM) account name form.

For example, say you want to display the SAM account name (domain\username) of the trustees listed in the access control list (ACL) on an object that is located on a remote workstation and contains local accounts in the ACL. You use ADsSecurity.dll to enumerate the ACLs on an object on a remote workstation. The trustee values found in the ACL for users or groups in the local workstation's SAM appear in SDDL format (similar to s-x-x-x-x), not in the SAM account name format. To display these trustees in SAM account name format you must convert from the SDDL form. On Windows 2000/XP/2003 use ConvertStringSidToSid API to convert the Sid to String. The method defined in this knowledge base article is intended for use on Windows NT 4.0.



MORE INFORMATION
The SID for a trustee is stored in binary form on the ACL. The binary SID is not human-readable.

The IADsAccessControlEntry interface enables directory clients to access and manipulate individual access control entries (ACEs) of the object. IADsAccessControlEntry attempts to convert the trustee's binary SID into a more human-readable form by using the LookupAccountSID function.

LookupAccountSID can be executed remotely. In this case, it is executed on the local system. The LookupAccountSID API will search all of the trusted domains and return the domain and userID for the trustee's SID. However, in this scenario, the trustee is stored in the untrusted remote workstation's SAM. The LookupAccountSID API will fail to resolve the binary SID. When the API fails, the trustee is converted into the SDDL form and placed in the IADsAccessControlEntry::Trustee property.

The process for converting the SDDL form of the SID into a binary SID, which can then be used in a call to the LookupAccountSid API to return the SAM account name form is as follows:
 * 1) Parse the SDDL form of the SID found in the IADsAccessControlEntry::Trustee property so that the issuing authority and the subauthority relative identifiers (RIDs) can be determined.
 * 2) Initialize a binary SID with the appropriate number of subauthorities.
 * 3) Build the binary SID by adding the appropriate subauthorities in the proper order.
 * 4) Use the newly created binary SID in a LookupAccountSid call targeting the local computer were the SDDL SID was obtained.

Sample code
This section contains Microsoft Visual Basic and Microsoft Visual C++ source code to convert a SDDL SID into a SAM account name.

Visual Basic code
' This code is meant to be used as an example of how one could convert ' the SDDL form of a SID into the SAM Account Name form. ' The class module defines two functions, ' ConvertSDDLtoSam which takes an SDDL form of a SID along with a target server ' and returns the Domain\user (SAM Account Name ) form of the SID. ' ' GetSubAuthorityFromSDDL, a helper function that walks the sub authorities. ' Option Explicit

Private SidCount As Integer Private Osid As New ADsSID Const LMEM_ZEROINIT = &H40 ' ' Declare the APIs needed to manipulate the binary SID ' Private Declare Function InitializeSid Lib &quot;advapi32.dll&quot; (ByVal Sid As Long, pIndentifierAuthority As Any, ByVal nSubAuthorityCount As Byte) As Long Private Declare Function GetSidSubAuthority Lib &quot;advapi32.dll&quot; (ByVal Sid As Long, ByVal nSubAuthority As Long) As Long Private Declare Function GetSidLengthRequired Lib &quot;advapi32.dll&quot; (ByVal nSubAuthorityCount As Byte) As Long Private Declare Function LookupAccountSid Lib &quot;advapi32.dll&quot; Alias &quot;LookupAccountSidA&quot; _ (ByVal lpSystemName As String, Sid As Any, ByVal name As String, cbName As Long, _   ByVal ReferencedDomainName As String, cbReferencedDomainName As Long, peUse As Integer) As Long ' ' Declare the memory management functions. ' Notice there are two definitions for RtlMoveMemory, ' one takes a value as Any, the other takes a value ByVal as long ' this is necessary so memory can be copied as follows: ' From a variable containing a 32 bit value that represents a memory location ' From a variable that represents a VB allocated memory location ' (ie: Dim bByte(6) as Byte type of declaration). ' ' LocalAlloc and LocalFree are used to allocate and free memory from the heap, 'respectively. ' Private Declare Sub CopyByValMemory Lib &quot;kernel32&quot; Alias &quot;RtlMoveMemory&quot; (Destination As Any, ByVal Source As Long, ByVal Length As Long) Private Declare Sub CopyByRefMemory Lib &quot;kernel32&quot; Alias &quot;RtlMoveMemory&quot; (ByVal Destination As Long, Source As Any, ByVal Length As Long) Private Declare Function LocalAlloc Lib &quot;kernel32&quot; (ByVal wFlags As Long, ByVal wBytes As Long) As Long Private Declare Function LocalFree Lib &quot;kernel32&quot; (ByVal hMem As Long) As Long Private Declare Function ConvertStringSidToSid Lib &quot;advapi32.dll&quot; Alias &quot;ConvertStringSidToSidA&quot; (ByVal StringSid As String, ByRef pSID As Long) As Boolean

' ' ConvertSDDLtoSAM, see above comments for a description. ' Public Function ConvertSDDLtoSAM(strSDDL As String, Target As String) As String Dim stInt As Integer, strEnd As Integer Dim iEndPosition As Integer, AuthorityCount As Integer Dim AuthorityStrings(15) As String Dim Authority As String, lngSSubAuthority As Long Dim mByte As Byte, str As String Dim lngSid As Long, clssid As Long Dim One As Integer, bRelValue As Long Dim strUser As String * 255, strDomain As String * 255 Dim Retval As Integer, Counter As Integer Dim lngRid As Long, cbSidLength As Long Dim bIdentifier(1 To 6) As Byte ' ' Fill the AuthorityStrings array with the appropriate values. ' AuthorityStrings(1) - The SID revision level ' AuthroityStrings(2) - The issuing authority ' AuthorityStrings(3) - 0th sub authority RID ' . ' .  ' .  ' AuthorityStrings(n) - Nth sub authority RID ' AuthorityCount = 1 Authority = GetSubAthorityFromSDDL(strSDDL, 1, iEndPosition) AuthorityStrings(AuthorityCount) = Authority ' ' Walk the rest of the sub authorities and place them into ' the string array ' Do    Authority = GetSubAthorityFromSDDL(strSDDL, iEndPosition, iEndPosition) If (Len(Authority) > 0) Then AuthorityCount = AuthorityCount + 1 AuthorityStrings(AuthorityCount) = Authority End If Loop While (iEndPosition > 0) ' ' Initialize the security identifier. AuthorityCount - 2 should be total ' number of sub authorities that need to be added to the ' the SID. Use InitializeSid to create a SID using the proper authority (stored ' in the second location of AuthorityStrings) and add the appropriate number of sub ' authorities. ' ' Retrieve the SubAuthority count '   Retval = CInt(AuthorityStrings(2)) ' ' Place that value into the appropriate Identifier array position. ' Just by coincidence, the Issuing Authority array and the ' issuing authority portion of the SDDL SID are the same number, so ' the structure ends up 0,0,0,0,0,CInt(AuthorityStrings(2)) '   bIdentifier(6) = Retval ' ' Get a total SubAuthority count '   SidCount = AuthorityCount - 2 ' ' Retrieve the overall required size for the sid ' We must know how many bytes will be needed to build the binary ' sid, GetSidLengthRequired will return that information '   cbSidLength = GetSidLengthRequired(SidCount) ReDim mByte(cbSidLength) ' ' Allocate Memory for the binary SID '   clssid = LocalAlloc(LMEM_ZEROINIT, cbSidLength) ' ' Its time to Initialize the SID. ' Call InitializeSid to populate sid buffer. InitializeSid ' properly initializes the issuing authority and revision sections ' of the binary sid '   lngSid = InitializeSid(clssid, bIdentifier(1), SidCount) ' ' Build the binary sid using GetSidSubAuthoriy API. The API ' returns an pointer to the location for the Sub Authority rid. ' Sub authority RIDs are stored in location 3 - AuthorityCount ' in the AuthorityStrings array. Simply convert the string form of ' the RID into a long and copy the memory into the pointer returned ' by GetSidSubAuthority '

For Counter = 3 To AuthorityCount lngSSubAuthority = GetSidSubAuthority(clssid, Counter - 3) If val(AuthorityStrings(Counter))<2147483648# Then lngRid = CLng(AuthorityStrings(Counter)) Else lngRid = val(AuthorityStrings(Counter)) - 4294967296# End If       CopyByRefMemory lngSSubAuthority, lngRid, LenB(lngRid) CopyByValMemory mByte(0), clssid, cbSidLength Next Counter ' ' We need to copy the binary SID into a byte buffer so we can pass it to  ' the LookupAccountSid API. This API is targeted to a particular server ' Copying the memory allows us to view the contents of the binary sid in the ' watch window of our VB application. '   ReDim mByte(cbSidLength) CopyByValMemory mByte(0), clssid, cbSidLength ' ' Use LookAccountSid to resolve the  Domain\Username of the ' SID. '   bRelValue = LookupAccountSid(Target, mByte(0), strUser, Len(strUser), strDomain, Len(strDomain), 1) ' ' Clean up the domain and userID strings. the return value of LookupAccountSid should be ' checked to be sure that the functions completed successfully '   strUser = Left(strUser, InStr(strUser, Chr(0)) - 1) strDomain = Left(strDomain, InStr(strDomain, Chr(0)) - 1) ConvertSDDLtoSAM = Trim(strDomain) & &quot;\&quot; & Trim(strUser) ' ' Since we allocated memory for the binary SID, we must release it otherwise we  ' cause a memory leak. The leak is not severe, but over time could add up. '   LocalFree clssid End Function ' ' GetSubAuthorityFromSDDL starts at startposition ' and returns the next &quot;-&quot; at the end as endposition. ' When the end of the descriptor is found, endposition = 0. ' ' If for some reason, a starting &quot;-&quot; is not found, then the function will ' return &quot;&quot; as the authority and endposition = 0. ' Private Function GetSubAthorityFromSDDL(strSDDL As String, _                               startposition As Integer, _                                endposition As Integer) As String Dim stInt As Integer Dim strEnd As Integer Dim subAuthStart As Long Dim SubAuthEnd As Long Dim Authority As String ' Find the base authority ' subAuthStart = InStr(startposition, strSDDL, &quot;-&quot;, vbTextCompare) If (subAuthStart = 0) Then '   ' Could not locate the leading &quot;-&quot;, set the error condition and return '   endposition = 0 GetSubAthorityFromSDDL = &quot;&quot; Else '    ' Found the leading &quot;-&quot;, search for the ending &quot;-&quot; '    SubAuthEnd = InStr(subAuthStart + 1, strSDDL, &quot;-&quot;, vbTextCompare) If (SubAuthEnd = 0) Then '      ' Did not not locate an ending &quot;-&quot;, set ' the endposition value to 0 and return everything from the ' first &quot;-&quot; to the end of the string '      Authority = Mid(strSDDL, subAuthStart + 1) endposition = 0 GetSubAthorityFromSDDL = Authority Else '      ' Found the ending &quot;-&quot;, set endposition to its location ' and return all the characters from the first &quot;-&quot; to this location '      Authority = Mid(strSDDL, (subAuthStart + 1), ((SubAuthEnd - 1) - subAuthStart)) endposition = SubAuthEnd GetSubAthorityFromSDDL = Authority End If End If End Function

Visual C++ code
// SDDLsid.cpp : Defines the entry point for the console application. //

// // Helper Function STUBS // // Function to locate sub authorities // UCHAR FindSubAuthorities( char* pSDDL, char *pAuths[] ); // // Take the sub authorities array from FindSubAuthories and // build a SID; return a pointer to it. // PSID BuildSidFromAuthorities( char *pAuths[], UCHAR lcAuths); // // //- // Main console application executable. // int main(int argc, char* argv[]) {   char *lpszSDDL; char *pStr, *pTarget; char *pAuthorities[MAX_SUB_AUTHORITIES]; UCHAR nAuthorities = 0; PSID pRawSID; PSID pSysSID = NULL; DWORD cbSysSID = 0; //char szDomain[256]; //DWORD cbszDomain = 256; SID_NAME_USE pSNU; if( argc < 3 ) {       printf(&quot;Error, need a SDDL form of a SID\nExample: SDDLSid S-1-2-3-55569832-2398475 \\\\Target_Server\n&quot;); return 0; }   lpszSDDL = (char *)malloc(strlen(argv[1])+1); pStr = argv[1]; pTarget = argv[2]; strcpy( lpszSDDL, (pStr+2)); //    // Find all of the sub authorities in the SDDL SID // See comments on FindSubAuthorities for details //    nAuthorities = FindSubAuthorities( lpszSDDL, pAuthorities ); long j = 0; printf(&quot;Sub authority Count: %d\nSub Authority Values:\n&quot;, nAuthorities); //    // Display the sub-Authority values //    for ( j = 0; j <= nAuthorities; j++ ) printf(&quot;%s\n&quot;,pAuthorities[j]); //    // Build a binary SID from the sub authorities // See comments in BuildSidFromAuthorities for details //    pRawSID = BuildSidFromAuthorities( pAuthorities, nAuthorities ); /*   Test code block used to verify that the code is functioning properlly. Took a known SID, converted it to SDDL on Win2k, then used that SDDL sid in the code for testing purposes.
 * 1) include &quot;stdafx.h&quot;
 * 2) define MAX_SUB_AUTHORITIES 15

if( !LookupAccountName(&quot;LOCAL_SERVER&quot;,&quot;FordP&quot;, pSysSID, &cbSysSID, szDomain, &cbszDomain, &pSNU) ) {       DWORD lstErr = GetLastError; if( lstErr == 122 ) {       pSysSID = (PSID)LocalAlloc(LPTR, cbSysSID); LookupAccountName(&quot;\\\\maxvdc1&quot;,&quot;FordP&quot;, pSysSID, &cbSysSID, szDomain, &cbszDomain, &pSNU); if( EqualSid( pSysSID, pRawSID )) printf(&quot;Sids are =\n&quot;); else printf(&quot;SIDS are <> \n&quot;); }   }    else printf(&quot;%d\n&quot;,GetLastError); if( pRawSID ) {       //         // Have a binary SID, lets retrieve the domain and user ID        //

char UserID[30]; char DomainID[256]; DWORD cbUserId = 30; DWORD cbDomainId = 256; BOOL bRet; bRet= LookupAccountSid(                              &quot;\\\\maxvdc1&quot;,        // name of local or remote computer                               pRawSID,               // security identifier                               UserID,                // account name buffer                               &cbUserId,             // size of account name buffer                               DomainID,              // domain name                               &cbDomainId,           // size of domain name buffer                               &pSNU                   // SID type                               ); if( bRet ) printf(&quot;SAM account form of %s \n is %s\\%s\n&quot;, argv[1], DomainID, UserID); else printf(&quot;Could not locate SID %d\n&quot;, GetLastError);

}   //     // Clean up all the memory allocated by the console application //    if ( pRawSID )  LocalFree( (HLOCAL)pRawSID ); if ( lpszSDDL ) free ( lpszSDDL );

return 0; } // // long FindSubAuthorities( char *pSDDL, char *pAuths[] ); // // The return value is the number of sub authorities in the SID. // Basically, the routine takes the SDDL form, searches for &quot;-&quot; characters // and replaces them with NULLs and places a pointer to the start of // the authority in the pAuths array so that each authority is separated by // nulls. // // Example: // // SDDL SID-> S-1-5-21-853885456-2109860151-3743179773-1190 // would be converted to: // S\01\05\021\0853885456\02109860151\03743179773\01190 // and the pAuths pointer array would be filled like: // pAuths[0] -> pointer to '1' // pAuths[1] -> pointer to '21' // pAuths[2] -> pointer to '853885456' // pAuths[3] -> pointer to '2109860151' // pAuths[4] -> pointer to '3743179773' // pAuths[5] -> pointer to '1190' // // The return value would be 5 // // RETURN VALUES: // Number of Sub Authorities found in the SDDL string // UCHAR FindSubAuthorities( char *pSDDL, char *pAuths[] ) {   char *strt; BOOL bEnd = FALSE; long lSubs = 0; pAuths[lSubs] = pSDDL; for( strt = pSDDL; *strt; strt++) {      switch( *strt ) {      case '-': bEnd = TRUE; *strt = NULL; lSubs++; break; default: if( bEnd ) {              pAuths[lSubs] = strt; bEnd = FALSE; }          break; }   }    return (UCHAR)(lSubs - 1); } // // PSID BuildSidFromAuthorities( char *pAuths[]); // This function takes an array that has been parsed by // FindSubAuthorities function and converts it to a binary sid. // // RETURN VALUES: // Returns NULL if the SID could not be created. // Returns a PSID pointer if the SID was created successfully // PSID BuildSidFromAuthorities( char *pAuths[], UCHAR lcAuths) {   //     // Allocate memory for the SID, this memory must be freed by the caller //    PSID pLocalSid = (PSID)LocalAlloc(LPTR, GetSidLengthRequired(lcAuths)); BOOL bRet; //    // The Authorities array contains pointer to the start of each sub authority. // the pAuths[0] is pointing to the revisoin value, so we skip that one. // Then pAuths[1] is pointer to the issuing authority for the SID. This value is going // to be one of the values in the following case statement. //    // Initialize the SID with the issuing authority and the number of sub authorities //    switch( pAuths[1][0] ) {   case '0': {           //             // SECURITY_NULL_SID_AUTHORITY //            SID_IDENTIFIER_AUTHORITY sAuth = SECURITY_NULL_SID_AUTHORITY; bRet = InitializeSid( pLocalSid, &sAuth, lcAuths); }

break;

case '1': {       //         // SECURITY_WORLD_SID_AUTHORITY //        SID_IDENTIFIER_AUTHORITY sAuth = SECURITY_WORLD_SID_AUTHORITY; bRet = InitializeSid( pLocalSid, &sAuth, lcAuths); }       break; case '2': {       //         // SECURITY_LOCAL_SID_AUTHORITY //        SID_IDENTIFIER_AUTHORITY sAuth = SECURITY_LOCAL_SID_AUTHORITY; bRet = InitializeSid( pLocalSid, &sAuth, lcAuths); }       break; case '3': {       //         // SECURITY_CREATOR_SID_AUTHORITY //        SID_IDENTIFIER_AUTHORITY sAuth = SECURITY_CREATOR_SID_AUTHORITY; bRet = InitializeSid( pLocalSid, &sAuth, lcAuths); }       break; case'5': {       //         // SECURITY_NT_AUTHORITY //        SID_IDENTIFIER_AUTHORITY sAuth = SECURITY_NT_AUTHORITY; bRet = InitializeSid( pLocalSid, &sAuth, lcAuths); }       break; default: break; }   if( bRet ) {       //         // SID created successfully!, add the sub authorities by        // walking the pointers in the pAuths array, converting them to         // DWORD and shoving back into the SID. //        // The GetSidSubAuthority API returns a pointer to the location of        // a given sub authority. Once the string form of the subauthority is        // converted into a DWORD, it must be placed into the address pointed to by        // the return value of the GetSidSubAuthority API. //        // All of these operations could be done in a single line of code, but have been // seperated for clarity. //        long j;        for( j = 2; j <= lcAuths+1; j++) {           DWORD dwValue = (DWORD)atol(pAuths[j]); PDWORD pdwSubAuth = GetSidSubAuthority( pLocalSid, (j-2)); *pdwSubAuth = dwValue; }   }    else pLocalSid = NULL; return pLocalSid; }

