{"id":33,"title":"SID (Security Identifier) Analizi","content":"<p>SID'ler benzersizdir ve bir kez kullan\u0131ld\u0131ktan sonra asla tekrar kullan\u0131lmaz. Bu SID, olu\u015fturuldu\u011fu anda bu kullan\u0131c\u0131ya kal\u0131c\u0131 olarak atanm\u0131\u015ft\u0131r. a\u015fa\u011f\u0131daki yaz\u0131mda bu id lerin a&ccedil;\u0131klmas\u0131 yapmaya &ccedil;al\u0131\u015ft\u0131m S-1-5-21-11906xxxx-307557xxxx-203xxxxxx-1001 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2502 \u2514\u2500 Domain identifier \u2514\u2500 RID (Relative ID) \u2502 \u2502 \u2514\u2500\u2500\u2500 NT Authority \u2502 \u2514\u2500\u2500\u2500\u2500\u2500 Revision level \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500 SID prefix &nbsp; <strong>SID (Security Identifier)<\/strong> - Windows g&uuml;venlik tan\u0131mlay\u0131c\u0131s\u0131d\u0131r. \u0130smin gelmemesinin birka&ccedil; nedeni olabilir:<\/p>\r\n<ul>\r\n<li><strong>Silinmi\u015f Kullan\u0131c\u0131<\/strong>: Kullan\u0131c\u0131 domain'den silinmi\u015f ama yetkileri kalm\u0131\u015f<\/li>\r\n<li><strong>Orphaned SID<\/strong>: Yetim kalm\u0131\u015f g&uuml;venlik tan\u0131mlay\u0131c\u0131s\u0131<\/li>\r\n<li><strong>Domain Trust Sorunu<\/strong>: Domain g&uuml;ven ili\u015fkisi bozulmu\u015f<\/li>\r\n<li><strong>Ge&ccedil;ici Ba\u011flant\u0131 Sorunu<\/strong>: Domain controller'a ula\u015f\u0131lam\u0131yor<\/li>\r\n<\/ul>\r\n<h2>SID Analizi: S-1-5-21-11906xxxx-307557xxxx-203xxxxxx-1001<\/h2>\r\n<p>Bu SID'in yap\u0131s\u0131:<\/p>\r\n<ul>\r\n<li><strong>RID (Son k\u0131s\u0131m): 1001<\/strong> &rarr; Normal kullan\u0131c\u0131 hesab\u0131 (1000+ user account)<\/li>\r\n<li><strong>Domain SID<\/strong>: S-1-5-21-1190619309-3075576492-203137233<\/li>\r\n<\/ul>\r\n<h2>G&uuml;ncellenen Script &Ouml;zellikleri:<\/h2>\r\n<ol>\r\n<li><strong>SID &Ccedil;&ouml;z&uuml;mleme<\/strong>: SID'leri otomatik olarak kullan\u0131c\u0131 ad\u0131na &ccedil;evirmeye &ccedil;al\u0131\u015f\u0131r<\/li>\r\n<li><strong>Hata Y&ouml;netimi<\/strong>: SID &ccedil;&ouml;z&uuml;mlenemezse a&ccedil;\u0131klay\u0131c\u0131 mesaj verir<\/li>\r\n<li><strong>Ek Bilgi<\/strong>: Hem &ccedil;&ouml;z&uuml;mlenmi\u015f ad hem de orijinal SID'i g&ouml;sterir<\/li>\r\n<\/ol>\r\n<h2>Bu SID'in Muhtemel Durumlar\u0131:<\/h2>\r\n<ol>\r\n<li><strong>Silinmi\u015f Kullan\u0131c\u0131<\/strong>: En olas\u0131 durum - kullan\u0131c\u0131 domain'den silinmi\u015f ama yetkileri kalm\u0131\u015f<\/li>\r\n<li><strong>Orphaned Account<\/strong>: Hesap ba\u015fka domain'e ta\u015f\u0131nm\u0131\u015f<\/li>\r\n<li><strong>Ge&ccedil;ici Sorun<\/strong>: Domain controller ge&ccedil;ici olarak ula\u015f\u0131lam\u0131yor<\/li>\r\n<\/ol>\r\n<pre data-enlighter-language=\"python\"># SID'i isime &ccedil;evirme $sid = S-1-5-21-11906xxxx-307557xxxx-203xxxxxx-1001\" try { $objSID = New-Object System.Security.Principal.SecurityIdentifier($sid) $objUser = $objSID.Translate() Write-Host \"Kullan\u0131c\u0131: $($objUser.Value)\" } catch { Write-Host \"SID &ccedil;&ouml;z&uuml;mlenemedi - Muhtemelen silinmi\u015f kullan\u0131c\u0131\" }<\/pre>\r\n<h3>S-1-5-21-938383202-2505xxxxxx-xxxxxxxxx-43489 inceleyelim<\/h3>\r\n<p>&nbsp;<\/p>\r\n<h3>SID Bile\u015fenleri:<\/h3>\r\n<ul>\r\n<li><strong>S-1<\/strong>: SID revision 1 (standart)<\/li>\r\n<li><strong>5<\/strong>: NT Authority (Windows &ouml;zel SID)<\/li>\r\n<li><strong>21<\/strong>: Non-unique identifier (domain SID g&ouml;sterir)<\/li>\r\n<li>938383202-2505xxxxxx: Domain identifier (3 adet 32-bit say\u0131)<\/li>\r\n<li><strong>43489<\/strong>: RID (Relative Identifier)<\/li>\r\n<\/ul>\r\n<h3>RID Analizi - 43489:<\/h3>\r\n<p>RID de\u011feri 43489, normal kullan\u0131c\u0131 hesab\u0131 kategorisindedir &ccedil;&uuml;nk&uuml; 1000'den b&uuml;y&uuml;kt&uuml;r. Kullan\u0131c\u0131 SID'leri her zaman S-1-5-21 ile ba\u015flar ve RID de\u011feri 1000 veya daha b&uuml;y&uuml;k olur.<\/p>\r\n<ol>\r\n<li><strong>Hesap T&uuml;r&uuml;<\/strong>: Normal domain kullan\u0131c\u0131 hesab\u0131<\/li>\r\n<li><strong>RID Aral\u0131\u011f\u0131<\/strong>: 43489 &gt; 1000 (kullan\u0131c\u0131 hesab\u0131)<\/li>\r\n<li><strong>Domain<\/strong>: &Ouml;zel bir domain'e ait (domain identifier ile belirlenen)<\/li>\r\n<\/ol>\r\n<h3>&Ouml;nemli RID De\u011ferleri:<\/h3>\r\n<ul>\r\n<li><strong>500<\/strong>: Domain Administrator<\/li>\r\n<li><strong>501<\/strong>: Guest hesab\u0131<\/li>\r\n<li><strong>502<\/strong>: KRBTGT hesab\u0131<\/li>\r\n<li><strong>512<\/strong>: Domain Admins grubu<\/li>\r\n<li><strong>513<\/strong>: Domain Users grubu<\/li>\r\n<li><strong>1000+<\/strong>: Normal kullan\u0131c\u0131 hesaplar\u0131 (sizinki bu kategoride)<\/li>\r\n<\/ul>\r\n<h3>Bu SID Hakk\u0131nda:<\/h3>\r\n<p><strong>43489 RID de\u011feri<\/strong> olduk&ccedil;a y&uuml;ksek bir say\u0131, bu da:<\/p>\r\n<ul>\r\n<li>Bu domain'de &ccedil;ok say\u0131da kullan\u0131c\u0131\/grup olu\u015fturulmu\u015f oldu\u011funu<\/li>\r\n<li>Bu hesab\u0131n g&ouml;rece ge&ccedil; olu\u015fturuldu\u011funu<\/li>\r\n<li>Aktif bir domain ortam\u0131nda oldu\u011funuzu g&ouml;sterir<\/li>\r\n<\/ul>\r\n<p>SID'ler benzersizdir ve bir kez kullan\u0131ld\u0131ktan sonra asla tekrar kullan\u0131lmaz. Bu SID, olu\u015fturuldu\u011fu anda bu kullan\u0131c\u0131ya kal\u0131c\u0131 olarak atanm\u0131\u015ft\u0131r.<\/p>\r\n<h2>SID Analizi:S-1-5-21-11906xxxx-307557xxxx-203xxxxxx-1001<\/h2>\r\n<h3>SID Bile\u015fenleri:<\/h3>\r\n<ul>\r\n<li><strong>S-1<\/strong>: SID revision 1 (standart)<\/li>\r\n<li><strong>5<\/strong>: NT Authority (Windows &ouml;zel SID)<\/li>\r\n<li><strong>21<\/strong>: Non-unique identifier (domain SID g&ouml;sterir)<\/li>\r\n<li><strong>1190619309-3075576492-203137233<\/strong>: Domain identifier (3 adet 32-bit say\u0131)<\/li>\r\n<li><strong>1001<\/strong>: RID (Relative Identifier)<\/li>\r\n<\/ul>\r\n<h3>RID Analizi - 1001:<\/h3>\r\n<p>RID de\u011feri 1001, normal kullan\u0131c\u0131 hesab\u0131 kategorisindedir &ccedil;&uuml;nk&uuml; 1000'den b&uuml;y&uuml;kt&uuml;r. Kullan\u0131c\u0131 SID'leri her zaman S-1-5-21 ile ba\u015flar ve RID de\u011feri 1000 veya daha b&uuml;y&uuml;k olur. <span data-state=\"closed\"><a href=\"https:\/\/learn.microsoft.com\/en-us\/windows-server\/identity\/ad-ds\/manage\/understand-security-identifiers\" target=\"_blank\" rel=\"noopener\">Microsoft Learn<\/a><\/span><span data-state=\"closed\"><a href=\"https:\/\/renenyffenegger.ch\/notes\/Windows\/security\/SID\/index\" target=\"_blank\" rel=\"noopener\">Rene Nyffenegger<\/a><\/span><\/p>\r\n<h3>Bu SID'in &Ouml;zellikleri:<\/h3>\r\n<ol>\r\n<li><strong>Hesap T&uuml;r&uuml;<\/strong>: Normal domain kullan\u0131c\u0131 hesab\u0131<\/li>\r\n<li><strong>RID De\u011feri<\/strong>: 1001 - Bu domain'de olu\u015fturulan ilk birka&ccedil; kullan\u0131c\u0131dan biri<\/li>\r\n<li><strong>Domain<\/strong>: Kendine &ouml;zel domain identifier'a sahip<\/li>\r\n<\/ol>\r\n<h3>RID 1001'in Anlam\u0131:<\/h3>\r\n<p><strong>1001 RID de\u011feri<\/strong> &ouml;zellikle &ouml;nemlidir &ccedil;&uuml;nk&uuml;:<\/p>\r\n<ul>\r\n<li>Domain'de olu\u015fturulan <strong>ilk normal kullan\u0131c\u0131lardan biri<\/strong> (genellikle 2. veya 3. kullan\u0131c\u0131)<\/li>\r\n<li>RID 1000 genellikle domain'deki ilk kullan\u0131c\u0131ya verilir<\/li>\r\n<li>Bu nedenle <strong>erken d&ouml;nem kullan\u0131c\u0131s\u0131<\/strong> veya <strong>&ouml;nemli bir hesap<\/strong> olabilir<\/li>\r\n<\/ul>\r\n<h3>&Ouml;nceki SID ile Kar\u015f\u0131la\u015ft\u0131rma:<\/h3>\r\n<table>\r\n<thead>\r\n<tr>\r\n<th>SID<\/th>\r\n<th>RID<\/th>\r\n<th>Durum<\/th>\r\n<\/tr>\r\n<\/thead>\r\n<tbody>\r\n<tr>\r\n<td>Bu SID<\/td>\r\n<td>1001<\/td>\r\n<td>Erken d&ouml;nem kullan\u0131c\u0131s\u0131<\/td>\r\n<\/tr>\r\n<tr>\r\n<td>&Ouml;nceki SID<\/td>\r\n<td>43489<\/td>\r\n<td>&Ccedil;ok sonradan olu\u015fturulmu\u015f<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n<h3>Domain Identifier Kar\u015f\u0131la\u015ft\u0131rmas\u0131:<\/h3>\r\n<ul>\r\n<li><strong>Bu SID<\/strong>: 1190619309-xxxxxxxxx-203137233<\/li>\r\n<li><strong>&Ouml;nceki SID<\/strong>: 938383xxx-xxxxxxxxx-1015948312<\/li>\r\n<\/ul>\r\n<p><strong>Farkl\u0131 domain identifier'lar<\/strong> &rarr; <strong>Farkl\u0131 domain'ler<\/strong><\/p>\r\n<h3>G&uuml;venlik A&ccedil;\u0131s\u0131ndan:<\/h3>\r\n<ol>\r\n<li><strong>RID 1001<\/strong> olmas\u0131 nedeniyle <strong>&ouml;nemli bir hesap<\/strong> olabilir<\/li>\r\n<li>E\u011fer bu hesap <strong>silinmi\u015f<\/strong> ama yetkileri kalm\u0131\u015fsa g&uuml;venlik riski<\/li>\r\n<li><strong>\u0130lk kullan\u0131c\u0131lar<\/strong> genellikle y&ouml;netici yetkilerine sahip olurlar<\/li>\r\n<\/ol>\r\n<p>Bu SID, farkl\u0131 bir domain'den gelen ve o domain'de olu\u015fturulan ilk birka&ccedil; kullan\u0131c\u0131dan birini temsil ediyor. RID de\u011ferinin d&uuml;\u015f&uuml;k olmas\u0131 (1001) bu hesab\u0131n domain'deki &ouml;nemli erken d&ouml;nem kullan\u0131c\u0131lar\u0131ndan biri oldu\u011funu g&ouml;sterir.<\/p>","excerpt":"SID'ler benzersizdir ve bir kez kullan\u0131ld\u0131ktan sonra asla tekrar kullan\u0131lmaz. Bu SID, olu\u015fturuldu\u011fu anda bu kullan\u0131c\u0131ya kal\u0131c\u0131 olarak...","created_at":"2025-07-10 12:57:52","updated_at":"2026-09-06 05:42:57","category_id":6,"view_count":631,"reading_time":4,"status":"published","editor_choice":0,"is_editor_choice":1,"published_at":"2025-07-10 12:57:00","featured_image":"resimyok.jpg","slug":"sid-security-identifier-analizi","category_name":"Sistem","category_slug":"sistem"}