Domain Membership and Machine SID
The machine's own name and SID, and the domain it is joined to, with that domain's SID.
Use it to confirm which domain the machine belongs to, and tell local accounts from domain ones by their SID prefix.
- SECURITY
- Accounts and RDP
What It Is
Every Windows machine is its own small account domain, with a name and a SID that all its local accounts share. A machine joined to Active Directory also belongs to a primary domain, which has a name and SID of its own. The Local Security Authority keeps both in the SECURITY hive, as small keys under Policy. A machine in a workgroup keeps the workgroup name there, with no domain SID.
What It Proves
PolPrDmN and PolPrDmS name the domain the machine was joined to when the hive was saved. PolAcDmS is the machine SID, the prefix every local account SID starts with.
What It Does Not Prove
They show the current join only, not earlier domains. Domain accounts are listed in the domain, not here, so match their SIDs against PolPrDmS.
Where It Lives
Domain Membership and Machine SID lives in the SECURITY hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SECURITY\C:\What It Looks Like
These are four values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| This is ws-042's machine SID. The SIDs of alice (1001) and support (1002) both start with it, so both are local accounts. |
| ws-042 is joined to the domain CORP, so domain accounts such as CORP\ |
| This is the domain SID. svc-backup's SID in ProfileList starts with it, which marks svc-backup as a CORP account, not a local one. |
| The domain's DNS name matches the corp |
How to Read It
PolAcDmN and PolAcDmS hold the machine's name and SID, and PolPrDmN and PolPrDmS the primary domain's name and SID. PolDnDDN holds the domain's DNS name. Each keeps its data in the default value, with the SIDs stored as raw bytes for a parser to decode. A SID that starts with PolAcDmS is a local account, and one that starts with PolPrDmS belongs to the domain. An empty PolPrDmS means the machine is in a workgroup.
- When Windows Writes It
- When the machine joins or leaves a domain or workgroup.
- Which Windows Versions
- Windows XP to 11
- Tools That Parse It
- Registry Explorer, RegRipper, RECmd
Hunt It
The domain and machine SIDs sit in the SECURITY hive, so parse a copy or read the keys with Velociraptor. Sign-in records show the same split, because each logon names its account domain.
DeviceName is the full name, so its suffix shows the DNS domain. JoinType describes the Microsoft Entra join, not the Active Directory domain SID.
// The device name with its domain suffix, and how it is joinedDeviceInfo| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Domain Membership and Machine SID shows.
- ProfileListMaps each SID with a profile to its folder, so the prefixes show which users are local and which belong to the domain.
- Computer NameGives the host name and DNS suffix, which should agree with the domain's DNS name here.
- SAM User AccountsLists the local accounts whose SIDs start with the machine SID.
Sources
The facts on this page come from these public pages, which say more on each point.