Skip SID translation for capability SIDs

[cosmo0920]

S-1-15-3- prefixed SIDs are used for indicating capabilities and not mapped for the actual users.
We need to skip SID translation to eliminate the needless trying to translate SIDs.

ref: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers#capability-sids

[daipom]

Thanks! I will see this tomorrow.

[daipom]

Thanks for this fix!
It looks good to me from a coding perspective, but I have a question about the purpose.
I understand it as follows. Is it correct?

• Some capability SIDs will cause ERROR_NONE_MAPPED.
• Some capability SIDs can be translated, but we are not happy with it.
• For performance improvements, all capability SIDs should be skipped.

[cosmo0920]

• Some capability SIDs will cause ERROR_NONE_MAPPED.

All of the capability SIDs will cause ERROR_NONE-MAPPED.
They are stored in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities.

In the screenshot, they have S-1-15-3- prefix.

A part of the performance perspectives, all of the capability SIDs should be skipped for SID translations.

Plus, Active Directory does not resolve the actual usernames with those SIDs.

[daipom]

Thanks!

All of the capability SIDs will cause ERROR_NONE-MAPPED.

On my local Windows 10 Home, I can confirm some simple capability SIDs can be translated.
I use PsGetSid.

$ PsGetsid S-1-15-3-1

PsGetSid v1.45 - Translates SIDs to names and vice versa
Copyright (C) 1999-2016 Mark Russinovich
Sysinternals - www.sysinternals.com

Account for XXX:
Well Known Group: APPLICATION PACKAGE AUTHORITY\インターネット接続

I'm not sure, but it looks like S-1-15-3-1 ~ S-1-15-3-10 are well-known capability SIDs, and they have SID names.
These 10 SIDs may be the exceptions.

Sorry, I'm not familiar with it.
If we can ignore these, this fix will be fine!

[daipom]

LGTM. Thanks for this enhancement!

Should we release v0.11.1 with this fix?

[cosmo0920]

Should we release v0.11.1 with this fix?

Yes. Let's release a point release if y'all have a cycle. It's not urgent but we need to release at the some point of future.

[ashie]

Should we release v0.11.1 with this fix?

I'll release it.

[daipom]

Thanks!