3.1.1.1.3 Builtin Domain Principal View

To construct the Builtin Domain Principal View, the following columns from the associated domain database MUST be used:

• sAMAccountName

• sAMAccountType

• objectSID

All objects that satisfy the following criteria MUST be part of this view:

• All three columns in the preceding list MUST have values.

• The value of the objectSID attribute MUST contain S-1-5-32 as its prefix.

The columns of such objects MUST be used to construct the Builtin Domain Principal View in the following manner:

• Domain DNS Name, Additional Security Principal Name, User Principal Name, Default User Principal Names, and Security Principal SID History columns are left empty.

• Security Principal SID is mapped from objectSID.

• Security Principal Name is mapped from sAMAccountName.

• Security Principal Type is mapped from sAMAccountType by using the following table.

  sAMAccountType most significant 4 bits	Security Principal Type
  0x3	SidTypeUser
  0x1	SidTypeGroup
  0x4 or 0x2: These values are treated identically by the protocol.	SidTypeAlias
  Otherwise	SidTypeUnknown

• Domain NetBIOS Name and Domain SID are mapped from the row of the Predefined Translation Database View whose security principal SID is S-1-5-32.

The following is an example of how this view is created:

• An object that represents the administrators group.

  Column	Value
  sAMAccountName	Administrators
  sAMAccountType	0x20000000
  objectSID	S-1-5-32-544

• The view created for that object.

  Column	Value
  Domain DNS Name
  Domain NetBIOS Name	Builtin
  Domain SID	S-1-5-32
  Security Principal Name	Administrators
  Additional Security Principal Name
  Default User Principal Names
  User Principal Name
  Security Principal SID	S-1-5-32-544
  Security Principal SID History
  Security Principal Type	SidTypeAlias