Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I found following page with documentation: Now there is a mysterious domain string in SID. I understand that when I want to use this sid with this mysterious string I should replace it with a correct domain SID. The question is where can I find this domain SID that I can put into the SID for system administrator (for example) in order to be able to check some rights later.

SID example: S-1-5-21domain-500.

This domain identifier probably should be in xxxxxxxxxx-xxxxxxxxx-xxxxxxxxx format.

share|improve this question
Can you rephrase your question? It's not clear what you're asking. – joeqwerty Jul 11 '11 at 15:10
-1 Please reword your question so we understand what you're asking. – Nixphoe Jul 11 '11 at 15:11
Ok, sorry, I give more details, in short I cannot understand what should I put under this domain in SIDs I found in msdn documentation. – Darqer Jul 11 '11 at 15:18
up vote 0 down vote accepted

You're still not being very clear. What tool are you using? What option are you trying to change and where is it? The S-1-5-21domain-500 opiton you linked is the domain Administrator account. The Domain is the SID identifier of your domain.

Based on what I think you're asking, I think this is what you're looking for.

Start > Run > adsiedit.msc and go to Default naming context > OU > CN=Users. Find your CN=Administrator account, right click and go to properties. Find the objectSid. You can see that it matches what the description says.

That will give you the SID. Now why you would need that, I'm not sure, but I really hope you don't change anything in ADSI.

share|improve this answer
That was something I was searching for, I can even get directly this domain SID when I look at the properties of the domain and locate 'object SID'. Thank you very much. – Darqer Jul 11 '11 at 20:41

Look up the SID for the domain controller. DCs do not have local machine SIDs.

getsid \\server1 account \\server2 account

getsid is intended to compare SIDs so you have to provide two of them.


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.