Should we handle SID(SecurityIdentifier) in secure?

Question

Hi,
I want to use SID to distinguish Window users during multiple accounts in a PC.

string winUser = WindowsIdentity.GetCurrent().User.ToString();

Should I handle this string in secure as kind of sensitive data?

I wonder if these are not recommended handling or not.

• Printing this SID string in the log file
• Saving SID at cloud DB.

Thanks.

Answer 1

Hello @NotAvailableCurrently ,

Yes, you can have a try.

Is SID considered as sensitive?: https://stackoverflow.com/questions/36572306/is-sid-considered-as-sensitive
Security assessment: Unsecure SID History attributes: https://learn.microsoft.com/en-us/defender-for-identity/cas-isp-unsecure-sid-history-attribute

Best regards,
Leila

----------

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hello @NotAvailableCurrently ,

We haven’t heard from you in a couple of days.
Is there any update from your side?

Answer 3

Hello @NotAvailableCurrently ,

Yes, we would not consider the SID as sensitive generally. The SID is used to identify objects in ACLs.
However, there are well known SIDs for builtin groups and accounts that make certain objects easily discoverable. So it is possible for a hacker to use that information for malicious purposes. https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/81d92bba-d22b-4a8c-908a-554ab29148ab?redirectedfrom=MSDN

Accounts configured with an unsecure SID History attribute are windows of opportunities for attackers and can expose risks. You may use security assessment to check for accounts with SID History attributes which Microsoft Defender for Identity profiles to be risky and take appropriate action to remove SID History attribute from the accounts using PowerShell. https://learn.microsoft.com/en-us/defender-for-identity/cas-isp-unsecure-sid-history-attribute

Please "Accept as Answer" if it helped so it can help others in community looking for help on similar topics. Thanks for your cooperation!