I believe that Shawn's format is correct. My guess is that there is a little confusion. [Wink]
quote:
01 05 000000000005 15000000 BC2E7001 633DBD3D 0E6D055C F4010000
The second item is only a count that represents the number of items that follow the "Identifier Authority". Five in this case.

This is the hex sid of the domain/Administrators, group

01 02 000000000005 20000000 20020000

Two items follow the "Identifier Authority" -> 000000000005

[ 03 May 2002, 05:25: Message edited by: Howard Bullock ]
_________________________
Home page: http://www.kixhelp.com/hb/