When an account is created, it is given a unique access number known as a security identifier (SID). Every group to which the user belongs has an associated SID. The user and related group SIDs together form the user account’s security token, which determines access levels to objects throughout the system and network.

SIDs from the security token are mapped to the access control list (ACL) of any object the user attempts to access.