Windows 2000 Cross-Domain SID Filtering Explained

In Microsoft Windows 2000, cross-domain resource access via SID (Security Identifier) Filtering is an essential security mechanism designed to prevent unauthorized elevation of privilege across external domain trusts. When users access resources located in a trusting domain, their authorization data—consisting of their user SID, group SIDs, and SID history—crosses domain boundaries. SID Filtering evaluates this incoming authorization payload, systematically discarding foreign or spoofed SIDs that improperly claim membership in privileged groups, thereby ensuring that access tokens generated on resource servers only contain legitimate, verified identifiers.

In native Windows 2000 Active Directory environments, cross-domain authentication relies on either Kerberos ticket-granting processes or NTLM pass-through authentication. During authentication, the trusted domain controller creates an authorization token containing the user's primary SID, group SIDs, and any attributes stored in sIDHistory. Because sIDHistory was originally designed for user migration, a compromised domain controller in a trusted domain could manipulate these attributes to inject high-privilege SIDs—such as Enterprise Admins or Domain Admins—into the user's authorization data, granting unauthorized access to resources in the trusting domain.

To neutralize this vulnerability, Windows 2000 introduced SID Filtering (also referred to as trust quarantine) via post-Service Pack updates and Service Pack 4 configurations using the Netdom utility.

When SID Filtering is enabled on an external trust, cross-domain resource access executes through the following operational steps:

  1. Authentication Request: A user in a trusted domain requests access to a target resource hosted within a trusting domain. The user's domain issues a referral ticket (via Kerberos) or initiates an NTLM authentication request containing the Privilege Attribute Certificate (PAC), which carries the user's complete SID list.

  2. Boundary Inspection: When the authentication request reaches a domain controller in the trusting domain, the system intercepts the PAC before issuing a local service ticket.

  3. Filtering Execution: The domain controller in the trusting domain applies strict filtering algorithms against every SID present in the PAC:

    • Domain SID Validation: SIDs claiming to belong to the trusting domain's own security authority are immediately stripped.
    • Well-Known SID Inspection: Privileged well-known SIDs (such as Domain Admins or Administrators) originating from an external domain namespace are blocked.
    • Trust Boundary Enforcement: Only SIDs that legitimately originate from the relative identifier (RID) space of the specific trusted domain are preserved.

  4. Sanitized Token Generation: Once all unauthorized or foreign SIDs are discarded, the trusting domain controller issues the service ticket containing only the validated SIDs.

  5. Resource Access Evaluation: The target server receives the sanitized ticket, builds the local access token for the user session, and compares the sanitized SIDs against the Discretionary Access Control Lists (DACLs) of the requested resource to grant or deny access.