Well-Known Security Principals
Well-Known Security Principals represent special identities defined by the Windows Server security system, such as Everyone, Local System, Principal Self and Authenticated Users.
Well-Known Security Principals
There are 33 well-known security principals that are explicitly defined in the WellKnown Security Principals container in the Configuration partition of a Windows Server 2025 based Active Directory forest -
| # . |
Name . |
SID . |
Description . |
Notes . |
1 |
Anonymous Logon |
S-1-5-7 |
A user who has logged on anonymously. |
|
2 |
Attested Key Property |
S-1-18-6 |
A security identifier that means that the key trust object had the attestation property set or used with Credential Guard. |
|
3 |
Authenticated Users |
S-1-5-11 |
A group that includes all users whose identities were authenticated when they logged on. Membership is controlled by the operating system. |
|
4 |
Authentication Authority Asserted Identity |
S-1-18-1 |
A security identifier that indicates that the client's identity is asserted by an authentication authority based on proof of possession of client credentials. |
|
5 |
Batch |
S-1-5-3 |
A group that implicitly includes all users who have logged on through a batch queue facility such as task scheduler jobs. Membership is controlled by the operating system. |
|
6 |
Console Logon |
S-1-2-1 |
A group that includes all users who are logged on to the physical console on a Windows machine. |
|
7 |
Creator Group |
S-1-3-1 |
A placeholder in an inheritable ACE. When the ACE is inherited, the system replaces this SID with the SID for the primary group of the object's current owner. The primary group is used only by the POSIX subsystem. |
|
8 |
Creator Owner |
S-1-3-0 |
A placeholder in an inheritable access control entry (ACE). When the ACE is inherited, the system replaces this SID with the SID for the object's current owner. |
|
9 |
Dialup |
S-1-5-1 |
A group that implicitly includes all users who are logged on to the system through a dial-up connection. Membership is controlled by the operating system. |
|
10 |
Digest Authentication |
S-1-5-64-21 |
A security identifier that is used when the Digest authentication package authenticates a client. |
|
11 |
Enterprise Domain Controllers |
S-1-5-9 |
A group that includes all domain controllers an Active Directory directory service forest of domains. Membership is controlled by the operating system. |
|
12 |
Everyone |
S-1-1-0 |
A group that includes all users, even anonymous users and guests. Membership is controlled by the operating system. |
|
13 |
Fresh public key identity |
S-1-18-3 |
A security identifier that indicates that a subject's identity is asserted by an authentication authority based on proof of current possession of the subject's public key credentials. |
|
14 |
Interactive |
S-1-5-4 |
A group that includes all users who have logged on interactively. Membership is controlled by the operating system. |
|
15 |
IUSR |
S-1-5-17 |
An account (specifically IUSR_computer) that is used by the default Internet Information Services (IIS) user for anonymous access to resources on a website. |
|
16 |
Key Trust |
S-1-18-4 |
A security identifier that means that the client's identity is based on proof of possession of public key credentials by using the key trust object. |
|
17 |
Local Service |
S-1-5-19 |
A security identifier for a predefined local account on Windows computers that has minimum privileges on the local computer and presents Anonymous credentials on the network. The name of the account is NT AUTHORITY\LocalService. It does not have a password. |
|
18 |
MFA Key Property |
S-1-18-5 |
A security identifier that indicates that the key trust object had the multifactor (MFA) authentication property. |
|
19 |
Network |
S-1-5-2 |
A group that implicitly includes all users who are logged on through a network connection. Membership is controlled by the operating system. |
|
20 |
Network Service |
S-1-5-20 |
A security identifier for a predefined local account on Windows computers that has minimum privileges on the local computer and acts as (i.e. goes across as) the computer on the network. The name of the account is NT AUTHORITY\NetworkService. It does not have a password. |
|
21 |
NTLM Authentication |
S-1-5-64-10 |
A security identifier that is used when the New Technology LAN Manager (NTLM) authentication package authenticates a client. |
|
22 |
Other Organization |
S-1-5-1000 |
A group that includes all users and computers from another organization. |
|
23 |
Owner Rights |
S-1-3-4 |
A group that represents the current owner of the object. When an ACE that specifies this SID is applied to an object, the system ignores the implicit READ_CONTROL and WRITE_DAC permissions for the object's owner. |
|
24 |
Proxy |
S-1-5-8 |
This security identifies a SECURITY_NT_AUTHORITY proxy. |
|
25 |
Remote Interactive Logon |
S-1-5-14 |
This security identifier represents all users who are currently logged on to a computer by using a Remote Desktop Protocol connection. Access tokens that contain this SID also contain the Interactive SID. |
|
26 |
Restricted |
S-1-5-12 |
This security identifier includes all users and computer that have restricted capabilities. This identity group is used by a process that is running in a restricted security context, such as when an application is run with the RunAs service. |
|
27 |
SChannel Authentication |
S-1-5-64-14 |
A security identifier that is used when the Secure Channel (Schannel) authentication package authenticates a client. |
|
28 |
Self |
S-1-5-10 |
A placeholder in an ACE on a user, group, or computer object in Active Directory. When you grant permissions to Principal Self, you grant them to the security principal represented by the object. During an access check, the operating system replaces the SID for Principal Self with the SID for the security principal represented by the object. |
|
29 |
Service |
S-1-5-6 |
A group that includes all security principals that have logged on as a service. Membership is controlled by the operating system. |
|
30 |
Service Asserted Identity |
S-1-18-2 |
A security identifier that denotes that the client's identity is asserted by a service. |
|
31 |
System |
S-1-5-18 |
A service account that is used by the operating system. |
|
32 |
Terminal Server User |
S-1-5-13 |
A group that includes all users who have logged on to a Terminal Services server. Membership is controlled by the operating system. |
|
33 |
This Organization |
S-1-5-15 |
A group that includes all users from the same Active Directory forest. It is only included with Active Directory accounts and added only by a Domain Controller. |