Glossary
Security identifier (SID)
The unique value Windows uses to identify an account or group, such as S-1-5-21-…-1001. BAM keeps one registry key per SID: that is how it attributes execution.
A security identifier (SID) is a unique, never-reused value that identifies a security principal — a user, group or computer account — for example S-1-5-21-3623811015-3361044348-30300820-1104. It is made of a revision, an identifier authority, a domain or machine identifier and a relative identifier (RID) for the account (Microsoft Learn).
BAM stores one key per SID, so each entry is attributed to an account. Resolve SIDs to names with ProfileList, the SAM hive or the domain. Well-known SIDs such as S-1-5-18 (LocalSystem) have fixed meanings. See BAM SID to username.