如何获取当前计算机的SID？

Question

我知道如何获取当前用户的SID。从概念上讲，答案是：

• 使用 OpenThreadToken （或 OpenProcessToken ）获得运行用户的安全性TOKEN
• 使用 GetTokenInformation 获取 TOKEN_USER 结构
• 然后TOKEN_USER.Sid是Sid

所以用伪代码：

String GetCurrentUserSid()
{
   // Get the calling thread's access token.
   TOKEN hToken;
   if (!OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, true, out hToken)
   { 
       if (GetLastError() != ERROR_NO_TOKEN)
          RaiseLastWin32Error();

       // No thread token exists, try again against the process token
       if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, out hToken)
          RaiseLastWin32Error();
   }
   try
   {
      // Obtain the size of the user information in the token.
      DWORD cbReturned;
      GetTokenInformation(hToken, TokenUser, nil, 0, out cbReturned);

      //Allocate memory and try again for real
      TOKEN_USER* tiUser = GetMemory(cbReturned);
      if (!GetTokenInformation(hToken, TokenUser, tiUser, cbReturned, out cbReturned))
      RaiseLastWin32Error();
   }
   finally
   {
      CloseHandle(hToken);
   }

   //Convert the structure to a string
   return SidToString(tiUser.User.Sid);
}

但是如何在当前机器上做到这一点？

String GetCurrentMachineSid()
{
   // TODO: Ask Stackoverflow
}

奖金阅读

• The Machine SID Duplication Myth (and Why Sysprep Matters)
• Machine SIDs and Domain SIDs
• How to find SID of computer

Answer 1

  

You can see the machine SID on your computer by running Sysinternals PsGetSid with no parameters

所以我只是在调试器中查看 PsGetSid 的操作方式。

它从POLICY_ACCOUNT_DOMAIN_INFO中获得 SID - DomainSid：指向帐户域的SID的指针

代码可以是下一个

LSA_HANDLE PolicyHandle;

LSA_OBJECT_ATTRIBUTES ObjectAttributes = { sizeof(ObjectAttributes) };

NTSTATUS status = LsaOpenPolicy(0, &ObjectAttributes, POLICY_VIEW_LOCAL_INFORMATION, &PolicyHandle);

if (0 <= status)
{
    POLICY_ACCOUNT_DOMAIN_INFO* ppadi;

    status = LsaQueryInformationPolicy(PolicyHandle, PolicyAccountDomainInformation, (void**)&ppadi);

    if (0 <= status)
    {
        PWSTR szSid;
        BOOL b = ConvertSidToStringSidW(ppadi->DomainSid, &szSid);
        LsaFreeMemory(ppadi);

        if (b)
        {
            DbgPrint("%S\n", szSid);
            LocalFree(szSid);
        }
    }

    LsaClose(PolicyHandle);
}