How to determine if a string is a User SID?

Question

In Windows Operating System, user SIDs are represented with a string such as :

S-5-1-76-1812374880-3438888550-261701130-6117

Is there any way that I can identify that such a string is a valid User SID?

Thanks.

Answer 1

If you need to check SID is SID, use SecurityIdentifier constructor inside try\catch.

This will not validate that this sid belongs to anyone\anything in the whole world.

---

SIDs are

• Always start with S
• For current, always continue with -1- (this is SID version, and there is only one)
• Continues with single SID_IDENTIFIER_AUTHORITY which is not more than 6 bytes, means this value is not more than 281474976710656 (15 characters)
• Continues with [1..14] - separated SID_IDENTIFIER_SUBAUTHORITY which are not more than 4 bytes wide (10 characters max)
• Optionally ends with RID - separated which is not more than 4 bytes wide (10 characters max)

More detailed refer to MS-AZOD, chapter 1.1.1.2

Answer 2

I found this slight variation helpful which allows for some well known security identifiers. For example, the well known sid Everyone S-1-1-0

^S-\d-(\d+-){1,14}\d+$