Windows: Service SID (S-1-5-80-…)

Calculation of the five numbers following S-1-5-80

The 5 numbers following the S-1-5-80- can be calculated in PowerShell as follows, for example for the Trusted Installer service.

$serviceName = "TrustedInstaller"
$bytes       = [Text.Encoding]::Unicode.GetBytes($serviceName.ToUpper())
$sha1        = [Security.Cryptography.SHA1]::Create()
$hash        = $sha1.ComputeHash($bytes)
$rids        = new-object UInt32[] 5
[Buffer]::BlockCopy($hash, 0, $rids, 0, $hash.Length)
'S-1-5-80-{0}-{1}-{2}-{3}-{4}' -f $rids[0], $rids[1], $rids[2], $rids[3], $rids[4]

When executed, these commands print:

S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464

I found this calculation in the Blog Tyranid's Lair: The Art of Becoming TrustedInstaller.

Apparently, this calculation can also be performed by the WinAPI function RtlCreateServiceSid.