1. What is a security principal in Windows?
Any human user account that can log in interactively Any entity Windows can authenticate and grant rights to, including users, groups, computers, and service accounts Any object stored in the Active Directory database Any account that has been granted administrative privileges 2. What makes a SID different from a username as an identifier?
A SID is case-insensitive, while a username is case-sensitive A SID is assigned once at creation, never changes for that principal's lifetime, and is never reused, even after the principal is deleted A SID is only assigned to accounts created by an administrator, while a username can be self-selected A SID is visible to end users, while a username is hidden in the directory 3. An administrator renames the built-in Administrator account, hoping to make it harder for an attacker to find. What actually happens to that account's identity?
The account gets a new SID, so it effectively becomes a new principal The account keeps its existing SID, including RID 500, so it can still be identified as the true built-in Administrator The account loses RID 500 and is reassigned a random RID from the domain's available pool Windows treats the rename as invalid and silently keeps the display name as Administrator 4. A team deletes a compromised account and creates a brand new account using the exact same username, expecting a clean slate with matching permissions. What actually happens?
The new account automatically inherits the old account's group memberships because the usernames match None of the old permissions or group memberships carry over, because the new account receives a completely new SID and is a different principal Only group memberships transfer automatically; individual file permissions must be reassigned manually The permissions transfer only if the new account is created within the same Active Directory session as the deletion 5. What distinguishes a well-known SID, like S-1-1-0 for Everyone, from a well-known RID, like 500 for the built-in Administrator?
A well-known SID is identical on every Windows installation because the operating system itself is the issuing authority; a well-known RID is only predictable as a number, since the domain prefix in front of it still varies per environment A well-known SID only applies to groups, while a well-known RID only applies to individual user accounts A well-known RID is identical on every Windows installation, while a well-known SID varies from domain to domain There is no meaningful difference; both terms describe the exact same kind of value 6. During enumeration, why would an experienced tester resolve accounts by SID instead of trusting the display name shown in a directory listing?
Because display names can be renamed or duplicated, while a SID, specifically RID 500 for the real Administrator or RID 512 for Domain Admins, reliably identifies an account's true role Because SIDs are shorter to type into command-line tools than full display names Because Active Directory stores SIDs on a separate server from display names, so display names cannot be queried directly Because renaming the Administrator account also assigns it a new RID that testers need to look up 7. What does the sIDHistory attribute allow, and why is it treated as sensitive?
It lets a principal carry additional SIDs beyond its own, which can grant it the access of a prior identity, a mechanism that SID-history-based attacks abuse to smuggle in privileges It keeps a permanent audit log of every SID ever issued within the domain It automatically revokes an account's old permissions once the account has been renamed It records every time a principal's RID changes over its lifetime 
