DMARC-Filter: OpenDMARC Filter v1.4.2 delorie.com 4A9H1eH53209417
Date: Sat, 9 Nov 2024 18:00:47 +0100
To: cygwin@cygwin.com
Subject: Re: Stable SIDs for "None"+'"Administrator" ?
Message-ID: <Zy-VP7xZu-39qcio@calimero.vinschen.de>
Mail-Followup-To: cygwin@cygwin.com
References: <CAKAoaQ==gSPA7eiJN9LiLMcR1ktfE9CUTE1Bzc1oMDBs1PQhqw@mail.gmail.com>
MIME-Version: 1.0
Content-Disposition: inline
In-Reply-To: <CAKAoaQ==gSPA7eiJN9LiLMcR1ktfE9CUTE1Bzc1oMDBs1PQhqw@mail.gmail.com>
Precedence: list
From: Corinna Vinschen via Cygwin <cygwin@cygwin.com>
Reply-To: cygwin@cygwin.com
Cc: Corinna Vinschen <corinna-cygwin@cygwin.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cygwin-bounces~archive-cygwin=delorie.com@cygwin.com
Sender: "Cygwin" <cygwin-bounces~archive-cygwin=delorie.com@cygwin.com>

On Nov  9 17:31, Roland Mainz via Cygwin wrote:
> Hi!
> 
> ----
> 
> Does anyone know a list of SIDs which can be used to get the
> user+group accounts for passwd entry "Adminstrator" and group entry
> "None" ?
> 
> Our problem is that the actual account names vary with the system
> locale, e.g. group entry "None" is "Kein" in "de_DE",  "Aucun" in
> fr_FR etc. ...
> ... so far we thought we fixed this by doing a lookup via SID, and
> then remembering the localised name.
> 
> But: The SIDs are apparently not stable between Windows versions.
> For example:
> ---- snip ----
> # Windows Server 2022/en
> $ getent group None
> None:S-1-5-21-168624908-967194555-3343779530-513:197121:
> # Windows Server 2019
> $ getent group None
> None:S-1-5-21-3286904461-661230000-4220857270-513:197121
> ---- snip ----

They *are* stable in that they are 

  ${Machine-SID}-513

> And if there is no such list, would $ mkgroup | egrep
> ':S-1-5-21-.+-513:' # be a suitable workaround ?

No.

  ${AD-SID|-513 == "Domain Users"

I have not the faintest idea what the MS guys were thinking at the time,
calling the group "None".  This is basically the equivalent of "Domain
Users" for local accounts on machines not being domain controller.  A
useful name would have been "Local Users" or "Machine Users", but,
well, it is what it is.

The safe way to check the SID is to fetch the machine SID attach the RID
513, and check for equality.


Corinna

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple