24. Windows SIDs

• On Windows NT/2000/XP/2003 systems that are part of a larger domain, SIDs can be found in the SAM database:

      HKLM\SAM\Domains\Accounts\Aliases\Members
  
      HKLM\SAM\Domains\Users
  

• But SIDs can also be found in other places, particularly in group memberships...