3 ms·
The hierarchical thing didn't really happen though -- there's no public SID registry. And machine/domain SIDs got pinned to 3 RIDs. So AD always had machine/d
by cryptonector 5y ago
The hierarchical thing didn't really happen though -- there's no public SID registry. And machine/domain SIDs got pinned to 3 RIDs. So AD always had machine/domain SID conflict issues. It would only ever not have had SID conflict issues if they had had a public SID registry or if you had to install Windows as a domain member rather than install then join (and if there had never been a forest-of-forests feature).
Once you accept that machine/domain SID conflicts can happen, the value of having arbitrarily long SIDs goes away and you might as well use UUIDs to ID domains.
- lukeh 5y agoOK, perhaps hierarchical wasn't the correct word; it's not hierarchical in the sense of reflecting a (possibly global) domain hierarchy, but it does consist a component that identifies the issuing authority, and a component that identifies the principal relative to that authority. So yes, a (UUID, RID) tuple would have worked just as well.
- cryptonector 5y agoHierarchical was correct. I think the intention must have been to have a registry. Clearly a registry didn't happen :/
- lukeh 5y agoWell, whilst they are hierarchical they’re really only used as unique authority identifier plus local identifier.