March 18, 2026, 3:02 p.m.

SID Filtering

Microsoft introduced SID filtering with Windows Server 2003 to prevent privilege escalation techniques. When a Trust relationship is established between two different domains, SID filtering will be automatically enabled. If a Trust relationship is established, an attacker in the opposite domain can modify the SID history (sIDHistory) to present themselves as more privileged on the accessed domain.

If a Trust relationship is established, the following PowerShell command can be used to list users with sIDHistory:

Get-aduser -filter * -properties sidhistory | Where sidhistory

If there is a user with active sIDHistory in this list, the SID history of these users can be deleted by entering the following command:

Netdom trust /domain: /enablesidhistory:No

In this example, is the domain where the resources are located, and is the domain providing access.