Re: Getting Windows "MACHINE SID" without fork() & exec()?

On 24/04/2026 00:55, Brian Inglis via Cygwin wrote:
> On 2026-04-23 13:27, René Berber via Cygwin wrote:
>> On 4/23/2026 11:07 AM, Takeshi Nishimura via Cygwin wrote:
>>
>>> Does Cygwin have a secret shell variable or /proc file which contains
>>> the current machine's MACHINE SID, without having to resort to calling
>>> an external program (no fork(), no exec(), please)?
>>
>> Create your own environment variable.  Store it once per bash session 
>> with .bashrc for example, or permanently with all the other Windows 
>> variables.
>>
>> Use PsGetSid to get the value into that variable (i.e. no super user 
>> access needed like with regtool.)
>
> No regtool or superuser access needed for most queries and regtool 
> accepts paths:
>
> $ l /proc/registry*/
> /proc/registry/:
> HKEY_CLASSES_ROOT/  HKEY_CURRENT_CONFIG/  HKEY_CURRENT_USER/ 
> HKEY_LOCAL_MACHINE/  HKEY_PERFORMANCE_DATA/  HKEY_USERS/
>
> /proc/registry32/:
> HKEY_CLASSES_ROOT/  HKEY_CURRENT_CONFIG/  HKEY_CURRENT_USER/ 
> HKEY_LOCAL_MACHINE/  HKEY_PERFORMANCE_DATA/  HKEY_USERS/
>
> /proc/registry64/:
> HKEY_CLASSES_ROOT/  HKEY_CURRENT_CONFIG/  HKEY_CURRENT_USER/ 
> HKEY_LOCAL_MACHINE/  HKEY_PERFORMANCE_DATA/  HKEY_USERS/
>
>> Ref: https://learn.microsoft.com/en-us/sysinternals/downloads/psgetsid
>>
>> Caveat: The first time you run PsGetSid it shows a popup with the 
>> license agreement.
>>
>> Example:
>> XPS-8930: ~
>> $ /home/reneb/bin/SysinternalsSuite/PsGetsid
>>
>> PsGetSid v1.44 - Translates SIDs to names and vice versa
>> Copyright (C) 1999-2008 Mark Russinovich
>> Sysinternals - www.sysinternals.com
>>
>> SID for \\XPS-8930:
>> S-1-5-21-3651791898-1415975337-2452924111
>>
>> XPS-8930: ~
>> $ /home/reneb/bin/SysinternalsSuite/PsGetsid |& tail -n 3
>> S-1-5-21-3651791898-1415975337-2452924111
>
> Do you mean like these values replaced by '*'?
>
> $ regtool list -v /proc/registry/HKEY_USERS/
> .DEFAULT\ ()
> S-1-5-18\ ()
> S-1-5-19\ ()
> S-1-5-20\ ()
> S-1-5-21-**********-**********-**********-1001\ ()
> S-1-5-21-**********-**********-**********-1001_Classes\ ()
> ...
>
> Of course, if the info is not yours, you probably will need elevated 
> access!
>
That particular list is only for users with a local home directory
(called "profile dir"in windows), and for which the per user
config registry are currently cached in memory due to use by one or
more processes.

There are Win32 functions which return the value directly from the
Windows component that owns it, for example this sequence, which
does not require any user to have recently logged on.  Wrapping in
cygwin-compatible code is left as an exercise for the reader.

// Note: On domain controllers, the machine sid is actually the
//   sid of thedomain for which this domain controller is the
//   Kerberos KDC.  This isa historical consequence of NT
//   versions before 5.00 stored the domainuser database with
//   the same code as the local user database of othermachines.
// Note: This code uses the NT OS API conventions, where each API
//    returns asigned 32 bit error code where < 0 is error,
//    >= 0 is success, see WinSDK/include/shared/ntstatus.h
// Note: This sample prefixes Win32 API names with the DLL that
//    exports them, adjust to how your code otherwise accesses
//    system calls
// Note: Most LsaXxxx() APIs exported by ADVAPI32 are actually
//    local RPC calls to the secure process that is the equivalent
//    of logind on Systemd/Linux.
// Note: The policy handle temporarily used by this code could be
//    shared with other tasks, such as looking up the local names
//    of accounts, listing trusted AD/Kerberos domains etc.  For
//    simplicity, it is just opened and closed by this self-contained
//    sample.

// Implement this function yourself, similar to strdup() from ANSI C,
//   But using ADVAPI32.GetLengthSid() instead of strlen()
PSID SampleDuplicateSid(PSID pSid0);

NTSTATUS STDCALL SampleGetMachineSid(PSID *ppMachineSid) {
   LSA_HANDLE                  hLsaPolicy = NULL;
   POLICY_ACCOUNT_DOMAIN_INFO *pAccountDomainInfo = NULL
   LSA_OBJECT_ATTRIBUTES       oattr;
   NTSTATUS                    ntStatus;

   bzero(&oattr, sizeof(oattr)
   ntStatus = ADVAPI32.LsaOpenPolicy(
NULL,
     &oattr,
     POLICY_VIEW_LOCAL_INFORMATION | POLICY_LOOKUP_NAMES,
     &hLsaPolicy)
if (ntStatus < 0)
     return ntStatus;

   ntStatus = ADVAPI32.LsaQueryInformationPolicy(
     hLsaPolicy,
     PolicyAccountDomainInformation,
     (PdwVOID*)(&pAccountDomainInfo))
(void)ADVAPI32.LsaClose(hLsaPolicy);
   if (ntStatus < 0)
     return ntStatus;

   ppMachineSid = SampleDuplicateSid(pAccountDomainInfo->DomainSid);
   if (!pMachineSid)
     ntStatus = STATUS_NO_MEMORY;
   ADVAPI32.LsaFreeMemory(pAccountDomainInfo)
   return ntStatus;
}



-- 
Jakob Bohm, CIO, partner, WiseMo A/S. https://www.wisemo.com
Transformervej 29, 2860 Soborg, Denmark. direct: +45 31 13 16 10 
<tel:+4531131610>
This message is only for its intended recipient, delete if misaddressed.
WiseMo - Remote Service Management for PCs, Phones and Embedded

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple