How do I decrypt Cliams Identification Encoding:

Question

I recenlty encountered exception in Distributed Cache services, When i looked at the logs i found out certain user account had timed out while trying to access App fabric services.

In Sharepoint logs File say s: Token Cache: Failed to get token from distributed cache for '0).w|s-1-5-21-1569013132-2106423733-3135404513-303780'.

How do i decrypt Encoded Claims Identifier to find out what account was affected?

What does this mean: 0).w|s-1-5-21-1569013132-2106423733-3135404513-303780

Thank You

Answer 1

It is claims form of user info stored in SharePoint .w means that it's windows account and after the | character is either login name or SID. SID is typically used for groups. You can try to use PowerShell to translate it to something meaningful:

$objSID = New-Object System.Security.Principal.SecurityIdentifier("s-1-5-21-1569013132-2106423733-3135404513-303780")
$objUser = $objSID.Translate( [System.Security.Principal.NTAccount])
$objUser.Value