• subscribe
November 30, 2009 12:00 AM

Q. I heard that having duplicate SIDs on workstations causes security problems on removable media. Is this true?

Windows IT Pro
InstantDoc ID #103220

A. Yes. Consider the following, paraphrased from an email from Jeremy Moskowitz of gpanswers.com:

Imagine you have three Windows NT or later machines. They're all clones, with the same SID. There are local accounts on each with the following computer name-user SID combos:

  • CompA: Fred (501), Wilma (502), Barney (503)
  • CompB: Jerry (501), Elaine (502), George (503)
  • CompC: Harry (501), Sally (502), Mom (503)

If Fred stores something on an external NTFS drive, it's only protected by his SID. That means that Jerry or Harry could read from Fred's drive. The same situation exists for Wilma, Elaine, and Sally and for Barney, George, and Mom. As you can see, SIDs must be changed to ensure that external NTFS (or stolen internal NTFS) drives can't be read by anyone other than the user who's written on the item's ACL.

There's a counter to this argument that says NTFS security on removable drives is worthless anyway, because there are many third party applications and services that can read NTFS and bypass the security.

Related Reading:

Check out hundreds more useful Q&As like this in John Savill's FAQ for Windows. Also, watch instructional videos made by John at ITTV.net.


ARTICLE TOOLS

Comments
  • Zac
    2 years ago
    Jan 12, 2010

    Sqldevman: John addressed Mark's post in the first article under related reading. Take a look at his opinion.

  • Mandy
    2 years ago
    Jan 07, 2010

    Dear Mr.Savill,
    have you read the Mark Russinovich's blog post "The Machine SID Duplication Myth" http://blogs.technet.com/markrussinovich/archive/2009/11/03/3291024.aspx ?
    So far only the case you mentioned is to be taken into account. IMHO, this one is not very harmful to the security if someone already has got your removable storage. Is encryption the only way to go with security?

You must log on before posting a comment.

Are you a new visitor? Register Here