SID History

The SID history is a special attribute of Active Directory objects meant to support migration scenarios. As the name indicates, it contains the previous SID (security identifier) of the object. Although the SID itself cannot be changed, objects can be assigned new SIDs if they are migrated from one Windows domain to another. Objects such as user accounts may therefore have historical SIDs from previous domains on top of their current SID.

The reason for storing the historical SID is to allow continued access to the previous domain. While migrating domains, users may still need to access resources from the old infrastructure. The problem is that the Access Control Lists (ACL) that check for the required permissions still use the historical SID. Therefore, storing old SIDs alongside new SIDs allows users to be identified across multiple domains.

Activating the SID history during domain migration might trigger a “token bloat”, also referred to as a “MaxTokenSize problem”.

[FREE WHITE PAPER] Best practices for access management in Microsoft® environments.

Read our white paper to learn how to best handle access rights in Microsoft® environments.

Go to download

[FREE WHITE PAPER] Best practices for access management in Microsoft® environments.

Read our white paper to learn how to best treat access rights in Microsoft® environments.

Go to download
Go to Top