<div class="content" name="Overview (synopsis)" uuid="7946e6e9-6b00-44bf-ac18-26bffeba2544"><p>The purpose of this protocol is to translate human-readable
names to <a href="e79f2680-84d9-4d34-bc78-5ab9e1255653#gt_83f2020d-0804-4840-a5ac-e06439d50f8d" data-linktype="relative-path">security
identifiers (SIDs)</a>, as specified in <a href="../ms-dtyp/cca27429-5689-4a16-b2b4-9325d93e4ba2" data-linktype="relative-path">[MS-DTYP]</a>
section <a href="../ms-dtyp/78eb9013-1c3a-4970-ad1f-2b1dad588a25" data-linktype="relative-path">2.4.2</a>,
and vice versa. The syntax of human-readable names is specified in section <a href="2c0e8a6d-df0f-4c77-bbeb-f7cd0f6b2361" data-linktype="relative-path">3.1.4.5</a>. For example, this
protocol can be used to translate &#34;corp\John&#34; to
&#34;S-1-5-21-397955417-626881126-188441444-1555&#34;, and vice versa.</p><p>This translation is needed for different scenarios, such as
managing access to resources. In Windows, access to resources is controlled by
a security descriptor attached to the resource. This security descriptor
contains a list of SIDs indicating the <a href="e79f2680-84d9-4d34-bc78-5ab9e1255653#gt_f3ef2572-95cf-4c5c-b3c9-551fd648f409" data-linktype="relative-path">security principals</a> and the
kind of access allowed or denied for those principals. In order for humans to
manage access to resources, translation occurs between SIDs (persisted within
security descriptors) and human-readable identifiers (in the user interface).</p><p>This protocol is intended for use between any two machines,
most frequently between a <a href="e79f2680-84d9-4d34-bc78-5ab9e1255653#gt_6234a38c-ed1b-4c69-969f-6e6479566f65" data-linktype="relative-path">domain
member</a> and a <a href="e79f2680-84d9-4d34-bc78-5ab9e1255653#gt_76a05049-3531-4abd-aec8-30e19954b4bd" data-linktype="relative-path">domain
controller (DC)</a> for that <a href="e79f2680-84d9-4d34-bc78-5ab9e1255653#gt_b0276eb2-4e65-4cf1-a718-e0920a614aca" data-linktype="relative-path">domain</a>.
This protocol can also be used between domain controllers for <a href="e79f2680-84d9-4d34-bc78-5ab9e1255653#gt_5ee032d0-d944-4acb-bbb5-b1cfc7df6db6" data-linktype="relative-path">trusting</a> domains or <a href="e79f2680-84d9-4d34-bc78-5ab9e1255653#gt_fd104241-4fb3-457c-b2c4-e0c18bb20b62" data-linktype="relative-path">forests</a>.</p><p>This protocol is a simple request/response-based <a href="e79f2680-84d9-4d34-bc78-5ab9e1255653#gt_8a7f6700-8311-45bc-af10-82e10accd331" data-linktype="relative-path">remote procedure call (RPC)</a>
protocol. There are no long-lived sessions, although clients are free to cache
the RPC connection and reuse it over time. A sample sequence of requests and
responses is shown in section <a href="b1c74144-daef-4246-8037-73922564e3d3" data-linktype="relative-path">4</a>. </p></div>