What Is the SID History?
Read on to learn why and how Windows stores historical SID data.
The SID history is a special attribute of Active Directory objects meant to support migration scenarios. As the name indicates, it contains the previous SID (security identifier) of the object. Although the SID itself cannot be changed, objects can be assigned new SIDs if they are migrated from one Windows domain to another. Objects such as user accounts may therefore have historical SIDs from previous domains on top of their current SID.
The reason for storing the historical SID is to allow continued access to the previous domain. While migrating domains, users may still need to access resources from the old infrastructure. The problem is that the Access Control Lists (ACL) that check for the required permissions still use the historical SID. Therefore, storing old SIDs alongside new SIDs allows users to be identified across multiple domains.
Activating the SID history during domain migration might trigger a โtoken bloatโ, also referred to as a โMaxTokenSize problemโ.
Best Practices for Access Management In Microsoftยฎ Environments
Our in-depth guide explains how to manage access securely and efficiently from a technical and organizational standpoint, including tips for implementation, reporting and auditing.